PT-2026-27622 · Nats.Io · Nats Server
CVE-2026-33249
·
Publicado
2026-03-24
·
Atualizado
2026-07-30
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
NATS-Server versions prior to 2.11.15
NATS-Server versions prior to 2.12.6
Description
NATS-Server, a high-performance server for NATS.io, is affected by an issue where a valid client utilizing message tracing headers can direct trace messages to any valid subject, even those the client lacks publish permissions for. The message payload is a legitimate trace message and is not controlled by an attacker.
Recommendations
Update NATS-Server to version 2.11.15 or later.
Update NATS-Server to version 2.12.6 or later.
Exploit
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Nats Server