Read the docs
TI-2026-25666 Aliases CVE-2026-33248GHSA-3f24-pcvm-5jqc

NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Priority LOW 19CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass, Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287 and CWE-295.

Summary

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix Partial nats-server (nats-io): 2.11.15, 2.12.6github.com/nats-io/nats-server/v2 (Go): 2.11.15, 2.12.6Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagenats-serverbefore 2.11.15; 2.12.0-RC.1 to before 2.12.62.11.15, 2.12.6Patch availableCNA
—github.com/nats-io/nats-server/v2 (Go)before 2.11.152.11.15Patch availableGHSA-3f24-pcvm-5jqc
—github.com/nats-io/nats-server/v2 (Go)2.12.0-RC.1 to before 2.12.62.12.6Patch availableGHSA-3f24-pcvm-5jqc
—github.com/nats-io/nats-server (Go)all versions—No fix listedGHSA-3f24-pcvm-5jqc
  • nats-server Vendorbackstage Affected before 2.11.15; 2.12.0-RC.1 to before 2.12.6 Fixed in 2.11.15, 2.12.6 Patch available CNA
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected before 2.11.15 Fixed in 2.11.15 Patch available GHSA-3f24-pcvm-5jqc
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.12.0-RC.1 to before 2.12.6 Fixed in 2.12.6 Patch available GHSA-3f24-pcvm-5jqc
  • github.com/nats-io/nats-server (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-3f24-pcvm-5jqc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*before 2.11.15; 2.12.0 to before 2.12.6Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* Versions before 2.11.15; 2.12.0 to before 2.12.6 Vulnerable ·backstage

Remediation

  • Fix · CNA nats-server (nats-io) Fixed in 2.11.15, 2.12.6
  • Fix · GHSA-3f24-pcvm-5jqc github.com/nats-io/nats-server/v2 (Go) Fixed in 2.11.15 Advisory →
  • Fix · GHSA-3f24-pcvm-5jqc github.com/nats-io/nats-server/v2 (Go) Fixed in 2.12.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Global HubAffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33248
  2. 2026-10-03 Alias added: GHSA-3f24-pcvm-5jqc

References

Advisory 3

Other 1

  • TI-2026-22233 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVSS 3.1HIGH 7.5
  • TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
  • TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
  • TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
  • TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
  • TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences