Advisoriesby Ibisnats-serverGHSA-9983-vrx2-fg9c
NATS JetStream has an authorization bypass through its Management API
No fix yet
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.
Problem Description
Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/nats-io/nats-server Go | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-285
- Also known as
- BIT-nats-2026-33222, CVE-2026-33222, GO-2026-4832
More nats-server advisories
All nats-server
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingCVE-2026-33248no fix yetNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersCVE-2026-33246no fix yetNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingCVE-2026-33223no fix yetNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219no fix yetNATS has pre-auth server panic via leafnode handlingCVE-2026-33218no fix yetNATS allows MQTT clients to bypass ACL checksCVE-2026-33217no fix yet