CVE-2026-33249CWE-863

NATS: Message tracing can be redirected to arbitrary subject

Medium · published March 25, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-25T20:21Z
EPSS history
Timeline
  • 25 MAR 20:21Z
    NATS: Message tracing can be redirected to arbitrary subject
    cvelistv5