NATS is vulnerable to MQTT hijacking via Client ID
Priority LOW 28CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed nats-server (nats-io): 2.11.15, 2.12.6github.com/nats-io/nats-server/v2 (Go): 2.11.15, 2.12.6Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | nats-server | before 2.11.15; 2.12.0-RC.1 to before 2.12.6 | 2.11.15, 2.12.6 | Patch available | CNA |
| — | github.com/nats-io/nats-server/v2 (Go) | before 2.11.15 | 2.11.15 | Patch available | GHSA-fcjp-h8cc-6879 |
| — | github.com/nats-io/nats-server/v2 (Go) | 2.12.0-RC.1 to before 2.12.6 | 2.12.6 | Patch available | GHSA-fcjp-h8cc-6879 |
- nats-server Vendorbackstage Affected before 2.11.15; 2.12.0-RC.1 to before 2.12.6 Fixed in 2.11.15, 2.12.6 Patch available CNA
- github.com/nats-io/nats-server/v2 (Go) Vendor— Affected before 2.11.15 Fixed in 2.11.15 Patch available GHSA-fcjp-h8cc-6879
- github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.12.0-RC.1 to before 2.12.6 Fixed in 2.12.6 Patch available GHSA-fcjp-h8cc-6879
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* | 2.0.0 to before 2.11.15; 2.12.0 to before 2.12.5 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.11.15; 2.12.0 to before 2.12.5 Vulnerable ·backstage
Remediation
- Fix · CNA nats-server (nats-io) Fixed in 2.11.15, 2.12.6
- Fix · GHSA-fcjp-h8cc-6879 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.11.15 Advisory →
- Fix · GHSA-fcjp-h8cc-6879 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.12.6 Advisory →
Red Hat 3 advisories
- RHSA-2026:23345 Released 2026-06-04 · Red Hat rating ImportantMulticluster Global Hub 1.6.2 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:22347 Released 2026-06-01 · Red Hat rating ImportantMulticluster Global Hub 1.4.5 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:21769 Released 2026-05-28 · Red Hat rating ImportantMulticluster Global Hub 1.5.4 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:22347 |
| Multicluster Global Hub 1.6.5 | Fixed | RHSA-2026:23345 |
| Red Hat multicluster global hub 1.5.3 | Fixed | RHSA-2026:21769 |
Not affected: 4 products
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.6.5
- Red Hat OpenShift Container Platform 4
- Red Hat multicluster global hub 1.5.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33215
- 2026-10-03 Alias added: GHSA-fcjp-h8cc-6879
References
More backstage Nats-server vulnerabilities
- TI-2026-22233 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVSS 3.1HIGH 7.5
- TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
- TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
- TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
- TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
- TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5
Sources
- CVE-2026-33215 · CVE Program
- CVE-2026-33215 · NVD
- FIRST EPSS
- GHSA-fcjp-h8cc-6879 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33215 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences