CVE-2026-33217: linuxfoundation nats-server Incorrect Authorization
CVSS: 7.1v3.1HighModified
AliasesUBUNTU-CVE-2026-33217DEBIAN-CVE-2026-33217CGA-59q6-rm8p-r58qCGA-62mp-2r3v-hpwjCGA-689j-8p6g-r4qmCGA-72p2-x8hw-327cCGA-85cx-24mv-4q32CGA-8xf5-9wmg-wr82CGA-9663-xqcx-6cg5CGA-9mww-mw7v-68rmCGA-cmrp-7qcm-2766CGA-cqr5-vh23-r8q6CGA-cvcp-3w57-qcwxCGA-g4mg-2m85-q4g8CGA-h49m-w3fj-jgm3CGA-j4ff-6x3w-363xCGA-m954-h743-6wp6CGA-mcw3-f5m3-p783CGA-p49q-4w85-r4jrCGA-pcv6-6c54-7pv2CGA-q6vc-r44r-gg47CGA-r7fq-hw7p-9rp3CGA-vc52-vcg5-6829CGA-x94w-q6c7-pppvCGA-xh9f-phxg-wh2rCGA-xhwp-8pwf-qh48GHSA-jxxm-27vp-c3m5BIT-nats-2026-33217GO-2026-4834CGA-22c8-chx3-5qpwCGA-2fv5-m6wf-j229CGA-324p-4jgm-759mCGA-36r9-cr88-vvrfCGA-3m74-5w2x-76hwCGA-4qwv-76gr-w783CGA-584m-2hv3-7rwmCGA-62p9-h3cp-p98pCGA-6cmr-rvv8-5frrCGA-7h6c-qhm5-2v8rCGA-862r-vcpp-2r37CGA-8v3x-m525-x2rfCGA-9hp9-26mj-f3wqCGA-c552-5334-29ffCGA-ffjx-h6jx-vh49CGA-fx3w-g97m-q6mcCGA-g526-49fv-3q55CGA-hm66-3p98-fqjmCGA-hqqp-gj9j-5r97CGA-j4fj-4hc5-v8rvCGA-jmj7-mrxx-jch9CGA-jq3r-jmxx-m6f4CGA-mwhv-f6fm-j52qCGA-pvvx-776f-6ch3CGA-q2pg-m288-cp6gCGA-qggg-m8qh-fw5fCGA-wrfv-cfqp-vpf5CGA-x57x-mf38-3m6qCGA-x953-wpmp-fp3fCGA-xg4q-r9r3-68wrCGA-xpmg-fwxg-jc94CGA-xxw4-9jrc-x38f
Published 25-03-2026Last modified 09-09-2026
Vulnerability summary
CVE-2026-33217 is a high (CVSS 7.1) Incorrect Authorization vulnerability in linuxfoundation nats-server. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.1% of scored vulnerabilities.
CVSS score
7.1/10
010
High · v3.1 (CVE.org)EPSS score
0.37%
0%100%
Low · +0.11 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 09-09-2026Last modifiedVulnerability information updated.
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NSources7 sources · 6.5–7.1
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- OSV · GoEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
+0.11 pp
From 0.26% on 20-09-2026
20-09-202620-10-2026
EPSS score0.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Affected systems
Chainguard28 products
- k3s< 1.35.2.1-r4
- k3s-1.32< 1.32.13.1-r7
- k3s-1.33< 1.33.9.1-r6
- k3s-static< 1.35.2.1-r4
- k3s-static-1.32< 1.32.13.1-r7
Wolfi12 products
- k3s< 1.35.2.1-r4
- k3s-1.32< 1.32.13.1-r7
- k3s-1.33< 1.33.9.1-r6
- k3s-static< 1.35.2.1-r4
- k3s-static-1.32< 1.32.13.1-r7
Debian1 product
- nats-serverAll versions (No fix recorded) | < 2.12.6-1
Github.com/nats-io1 product
- nats-serverAll versions (No fix recorded)
Github.com/nats-io/nats-server1 product
- v2< 2.11.15 | ≥ 2.12.0-RC.1, < 2.12.6
Linuxfoundation1 product
- nats-server< 2.11.15 | ≥ 2.12.0, < 2.12.6
Nats-io1 product
- nats-server< 2.11.15 | ≥ 2.12.0-RC.1, < 2.12.6
Ubuntu1 product
- nats-serverAll versions (No fix recorded)
8 vendors · 46 products
References
14 links- github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
