PT-2026-27519

CVE-2026-33215

Published

2026-03-24

Updated

2026-10-31

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server, a high-performance server for NATS.io, a cloud and edge native messaging system, contains a flaw where sessions and messages can be hijacked via MQTT Client ID malfeasance. The nats-server provides an MQTT client interface. No workarounds are available.

Recommendations Update to version 2.11.15 or later. Update to version 2.12.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Philpennock

Vendors

Affected products

Weakness enumeration

CWE-488: Exposure of Data Element to Wrong Session

CWE-287: Improper Authentication