CVE-2026-33217CWE-425CWE-863broken-access-control

CVE-2026-33217

High · published March 26, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weaknesses
CWE-425 · Direct Request ('Forced Browsing'); CWE-863 · Incorrect Authorization
Published
2026-03-26T00:16Z
Affected products (2)
ProductVersionsFixed in
linuxfoundation/nats-server< 2.11.152.11.15
linuxfoundation/nats-server≥ 2.12.0, < 2.12.62.12.6
References (8)
https://advisories.nats.io/CVE/secnote-2026-07.txt · [email protected]https://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5 · [email protected]https://access.redhat.com/errata/RHSA-2026:21769 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:22347 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:23345 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-33217 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2451446 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33217.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 25 MAR 19:43Z
    NATS allows MQTT clients to bypass ACL checks
    cvelistv5