CVE-2026-33248

mediumPriorität · verfolgen · 0EPSS 0.001 · 4. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.15% (4th) EPSS

CVSS 4.2 · medium

Is it mine?

14 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · bewertet 2026-10-27

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

4.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.9–4.2

v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 1.6 · Auswirkung 2.5

v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV

v3.13.9lowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-287USCWE-287USCWE-295USCWE-295US

betroffene Produkte (14)

Betroffene Produkte und Versionsbereiche.

Open Source NATS Server <2.11.15alle Versionencert_bundDE
Open Source NATS Server <2.12.6alle Versionencert_bundDE
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Open Source NATS Server< 2.11.15cert_bundDE
Open Source NATS Server< 2.12.6cert_bundDE
nats-io nats-server≤ < 2.11.15enisa_euvdEU
nats-io nats-server2.12.0-RC.1, → 2.12.6enisa_euvdEU
linuxfoundation nats-server< 2.11.15nvdUScpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*
linuxfoundation nats-server2.12.0 → 2.12.6nvdUScpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*
Bitnami nats< 2.11.15osvUSpkg:bitnami/nats
Bitnami nats2.12.0 → 2.12.6osvUSpkg:bitnami/nats
Go github.com/nats-io/nats-serveralle VersionenosvUSpkg:golang/github.com/nats-io/nats-server
Go github.com/nats-io/nats-server/v2< 2.11.15osvUSpkg:golang/github.com/nats-io/nats-server/v2
Go github.com/nats-io/nats-server/v22.12.0-RC.1 → 2.12.6osvUSpkg:golang/github.com/nats-io/nats-server/v2

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-0858NATS Server: Mehrere SchwachstellenDeutsch2026-03-24csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.
GHSA-3f24-pcvm-5jqcNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching2026-03-24ghsa · osvUS
### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate. ### Problem Description When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. ### Affected Versions Fixed in nats-server 2.12.6 & 2.11.15 ### Workarounds Developers should review their CA issuing practices.
BIT-nats-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching2026-03-27vendor · osvUS
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.
GO-2026-4828NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server2026-03-26vendor · osvUS
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

veröffentlicht 2026-03-25geändert 2026-06-17

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan