CVE-2026-33216: linuxfoundation nats-server Plaintext Storage of a Password

Vulnerability summary

CVE-2026-33216 is a high (CVSS 8.6) Plaintext Storage of a Password vulnerability in linuxfoundation nats-server. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.

Timeline

1. 25-03-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

• CWE-256Plaintext Storage of a PasswordThe product stores a password in plaintext within resources such as memory or files.
• CWE-213Exposure of Sensitive Information Due to Incompatible PoliciesThe product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.