CVE-2026-33222CWE-285

NATS JetStream has an authorization bypass through its Management API

Medium · published March 25, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-03-25T20:10Z
EPSS history
Timeline
  • 25 MAR 20:10Z
    NATS JetStream has an authorization bypass through its Management API
    cvelistv5