Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

36 records

Vendor: backstage Component: Nats-server Clear all filters
TI-2026-41953 CVE-2026-58253

NATS Server: Route API Auth Bypass

Priority LOW 38

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00368 Published 2026-07-08 Fixed in 2.11.16, 2.12.6 CWE-287
TI-2026-41951 CVE-2026-58251

NATS Server: Queue Subscribe Authz Bypass

Priority LOW 29

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00463 Published 2026-07-08 Fixed in 2.11.16, 2.12.7 CWE-285
TI-2026-25667 CVE-2026-33249 · GHSA-8m2x-3m6q-6w8j

NATS: Message tracing can be redirected to arbitrary subject

Priority LOW 20

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-03-25 Partial fix · 2.11.15, 2.12.6 CWE-863
TI-2026-25639 CVE-2026-33218 · GHSA-vprv-35vv-q339

NATS has pre-auth server panic via leafnode handling

Priority MEDIUM 40

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00627 Published 2026-03-25 Fixed in 2.12.6, 2.11.15 CWE-20
TI-2026-25638 CVE-2026-33217 · GHSA-jxxm-27vp-c3m5

NATS allows MQTT clients to bypass ACL checks

Priority LOW 31

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00264 Published 2026-03-25 Fixed in 2.11.15, 2.12.6 CWE-863
TI-2026-25637 CVE-2026-33216 · GHSA-v722-jcv5-w7mc

NATS has MQTT plaintext password disclosure

Priority MEDIUM 43

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00372 Published 2026-03-25 Fixed in 2.11.15, 2.12.6 CWE-256
TI-2026-25636 CVE-2026-33215 · GHSA-fcjp-h8cc-6879

NATS is vulnerable to MQTT hijacking via Client ID

Priority LOW 28

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00244 Published 2026-03-24 Fixed in 2.11.15, 2.12.6 CWE-287
Load more