PT-2026-27519

CVE-2026-33215

Publicado

2026-03-24

Atualizado

2026-10-31

Descrição por

CVSS 3.1

6.5

Média

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server, a high-performance server for NATS.io, a cloud and edge native messaging system, contains a flaw where sessions and messages can be hijacked via MQTT Client ID malfeasance. The nats-server provides an MQTT client interface. No workarounds are available.

Recommendations Update to version 2.11.15 or later. Update to version 2.12.6 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Philpennock

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-488: Exposure of Data Element to Wrong Session

CWE-287: Improper Authentication