Moderate severityNVD Advisory· Published Mar 25, 2026· Updated Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject
CVE-2026-33249
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/nats-io/nats-server/v2Go | >= 2.11.0, < 2.11.15 | 2.11.15 |
github.com/nats-io/nats-server/v2Go | >= 2.12.0-preview.1, < 2.12.6 | 2.12.6 |
Affected products
1- Range: >= 2.11.0, < 2.11.15
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-8m2x-3m6q-6w8jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33249ghsaADVISORY
- advisories.nats.io/CVE/secnote-2026-15.txtghsax_refsource_MISCWEB
- github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8jghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.