Session Hijacking Vulnerability in NATS-Server by NATS.io
CVE-2026-33215

6.5MEDIUM

Key Information:

Vendor

Nats-io

Status
Nats-server
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33215?

A vulnerability in NATS-Server, a high-performance messaging server for cloud and edge applications, exposes the system to potential session hijacking. This risk arises from malicious manipulation of the MQTT Client ID, enabling attackers to intercept and control sessions and messages. Users are advised to upgrade to NATS-Server versions 2.11.15 or 2.12.5, which rectify this issue. No workarounds currently exist to mitigate the risk.

Affected Version(s)

nats-server < 2.11.15 < 2.11.15

nats-server >= 2.12.0-RC.1, < 2.12.6 < 2.12.0-RC.1, 2.12.6

References

https://github.com/nats-io/nats-server/security/advisorie...
x_refsource_CONFIRM
https://advisories.nats.io/CVE/secnote-2026-06.tx
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.