Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-33215

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

VectorNETWORK

PublishedMar 24, 2026, 21:16

Published Bysecurity-advisories@github.com

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/nats-io/nats-server/v2(Go)02.11.15N/A

github.com/nats-io/nats-server/v2(Go)2.12.0-RC.12.12.6N/A

References

https://advisories.nats.io/CVE/secnote-2026-06.tx
https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879

Weakness Type

CWE-287

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK