CVE-2026-33215
NATS is vulnerable to MQTT hijacking via Client ID
Summary
NATS is vulnerable to MQTT hijacking via Client ID
Original description
The description as published by the source.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
nats
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.15"},{"introduced":"2.12.0"},{"fixed":"2.12.6"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-33215 nats-server
- Ubuntu UBUNTU-CVE-2026-33215 nats-server
References
- advisory advisories.nats.io
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com