nats-serverGHSA-9983-vrx2-fg9c
NATS JetStream has an authorization bypass through its Management API
Medium4.9CVE-2026-33222 · Published Mar 24, 2026 · updated Sep 10, 2026
### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore. ### Problem Description Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/nats-io/nats-server Go | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-285
- Also known as
- BIT-nats-2026-33222, CVE-2026-33222, GO-2026-4832
More nats-server advisories
All nats-server| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 24 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching Medium4.2Mar 24 | Medium4.2 | No fix yet |
| Mar 24 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersMedium6.4Mar 24 | Medium6.4 | No fix yet |
| Mar 24 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingMedium6.4Mar 24 | Medium6.4 | No fix yet |
| Mar 24 | NATS is vulnerable to pre-auth DoS through WebSockets client serviceMedium5.3Mar 24 | Medium5.3 | No fix yet |
| Mar 24 | NATS has pre-auth server panic via leafnode handlingHigh7.5Mar 24 | High7.5 | No fix yet |
| Mar 24 | NATS allows MQTT clients to bypass ACL checksHigh7.1Mar 24 | High7.1 | No fix yet |