PT-2026-27614 · Nats.Io · Nats Server

CVE-2026-33217

·

Publicado

2026-03-24

·

Atualizado

2026-08-24

CVSS v3.1

8.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6
Description NATS-Server is a high-performance server for NATS.io, a cloud and edge native messaging system. When using Access Control Lists (ACLs) on message subjects, these ACLs were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. This issue affects the MQTT client interface provided by nats-server. No known workarounds are available.
Recommendations Update to NATS-Server version 2.11.15 or later. Update to NATS-Server version 2.12.6 or later.

Exploit

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863CWE-425

Identificadores relacionados

BIT-NATS-2026-33217
CVE-2026-33217
GHSA-JXXM-27VP-C3M5
GO-2026-4834
JLSEC-2026-1125
OPENSUSE-SU-2026:21483-1
SUSE-SU-2026:1135-1

Produtos afetados

Nats Server