CVE-2026-33215
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
- EPSS probability
- 0.24%
- CWE
- CWE-287, CWE-488
- Published
- 2026-03-24
- Last modified
- 2026-03-25
Affected products
- nats-io nats-server
- nats-io nats-server
Weakness type
Related vulnerabilities
- CVE-2026-88018 — rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-88007 — Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88895 — CyberPanel before 3.0.5 Authentication Bypass via API
- CVE-2026-87924 — Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
- CVE-2026-87922 — Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
- CVE-2026-87016 — Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-87806 — Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password