BIT-nats-2026-33215

vendorUSosv

NATS is vulnerable to MQTT hijacking via Client ID

view advisory published 2026-03-27Licence: per source

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-33215US	medium6.5	0.24% (16th)	—	2026-03-24
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.1…

references

External citations — patches, advisories, analysis.

https://advisories.nats.io/CVE/secnote-2026-06.txWEB
https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-33215WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan