CVE-2026-33217
published 2026-03-25CVE-2026-33217: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on…
PriorityP339medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.26%
17.4th percentile
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nats-server | < nats-server 2.12.6-1 (forky) | nats-server 2.12.6-1 (forky) |
| github.com | nats-io_nats-server_v2 | >= 0 < 2.11.15 | 2.11.15 |
| github.com | nats-io_nats-server_v2 | >= 2.12.0-RC.1 < 2.12.6 | 2.12.6 |
| linuxfoundation | nats-server | < 2.11.15 | 2.11.15 |
| linuxfoundation | nats-server | >= 0 < 2.12.6-1 | 2.12.6-1 |
| linuxfoundation | nats-server | >= 2.12.0 < 2.12.6 | 2.12.6 |
| nats-io | nats-server | < 2.12.12 | 2.12.12 |
| nats-io | nats-server | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.5MEDIUM
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server
osv·2026-03-26
CVE-2026-33217 NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server
OSV
CVE-2026-33217: NATS-Server is a High-Performance server for NATS
osv·2026-03-25·CVSS 6.5
CVE-2026-33217 [MEDIUM] CVE-2026-33217: NATS-Server is a High-Performance server for NATS
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
OSV
NATS allows MQTT clients to bypass ACL checks
osv·2026-03-24
CVE-2026-33217 [HIGH] NATS allows MQTT clients to bypass ACL checks
NATS allows MQTT clients to bypass ACL checks
### Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
### Problem Description
When using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.
### Affected Versions
Any version before v2.12.6 or v2.11.15
### Workarounds
None.
GHSA
NATS allows MQTT clients to bypass ACL checks
ghsa·2026-03-24
CVE-2026-33217 [HIGH] CWE-863 NATS allows MQTT clients to bypass ACL checks
NATS allows MQTT clients to bypass ACL checks
### Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
### Problem Description
When using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.
### Affected Versions
Any version before v2.12.6 or v2.11.15
### Workarounds
None.
Red Hat
nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace
vendor_redhat·2026-03-25·CVSS 7.1
CVE-2026-33217 [HIGH] CWE-425 nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace
nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
A flaw was found in NATS-Server. When Access Control Lists (ACLs) were configured for message subjects, these controls were not correctly applied within the `$MQTT.>` namespace. This oversight allows MQTT clients to bypass the intended ACL checks, potentially granting unauthorized access to sensitive message sub
Debian
CVE-2026-33217: nats-server - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native me...
vendor_debian·2026·CVSS 7.1
CVE-2026-33217 [HIGH] CVE-2026-33217: nats-server - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native me...
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Scope: local
bookworm: open
forky: resolved (fixed in 2.12.6-1)
sid: resolved (fixed in 2.12.6-1)
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-33217 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-33217 [MEDIUM] CVE-2026-33217 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33217 :
NixOS vulnerability analysis and mitigation
$MQTT.>
Source : NVD
## 6.5
Score
Published March 25, 2026
Severity MEDIUM
CNA Score 7.1
Affected Technologies
NixOS
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nats
nats-server-fips
Sources
NVD
Chainguard Has Fix Added at: Mar 26, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 29, 2026
Debian 14 Severity MEDIUM Has Fix Added at: Mar 29, 2026
Echo Severity MEDIUM No Fix Added at: Mar 29, 2026
GoLang Severity HIGH Has Fix Added at: Mar 25, 2026
Homebrew Severity MEDIUM Has Fix Added at: Mar 29, 2026
MinimOS Severity MEDI
Bugzilla
CVE-2026-33217 nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace [fedora-all]
bugzilla·2026-03-25·CVSS 6.5
CVE-2026-33217 [MEDIUM] CVE-2026-33217 nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace [fedora-all]
CVE-2026-33217 nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
https://advisories.nats.io/CVE/secnote-2026-07.txthttps://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5https://access.redhat.com/errata/RHSA-2026:21769https://access.redhat.com/errata/RHSA-2026:22347https://access.redhat.com/errata/RHSA-2026:23345https://access.redhat.com/security/cve/CVE-2026-33217https://bugzilla.redhat.com/show_bug.cgi?id=2451446https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33217.json
2026-03-25
Published