Message Tracing Vulnerability in NATS-Server by NATS.io

CVE-2026-33249

What is CVE-2026-33249?

NATS-Server, a high-performance server for NATS.io, is vulnerable due to improper access control in its message tracing functionality. In versions 2.11.0 up to, but not including, 2.11.15 and 2.12.6, a valid client can exploit this flaw. By using message tracing headers, the client can redirect trace messages to arbitrary subjects, bypassing publish permissions. The payload of these trace messages is valid, meaning they are not controlled by the attacker. This vulnerability poses a risk as it allows unauthorized access to sensitive information. Users are strongly advised to update to fixed versions 2.11.15 or 2.12.6 to mitigate the risk associated with this vulnerability. For further details, refer to the official advisories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References