Advisoriesby Ibisnats-serverGHSA-jxxm-27vp-c3m5
NATS allows MQTT clients to bypass ACL checks
No fix yet
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
Problem Description
When using ACLs on message subjects, these ACLs were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
None.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/nats-io/nats-server Go | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- BIT-nats-2026-33217, CVE-2026-33217, GO-2026-4834
More nats-server advisories
All nats-server
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingCVE-2026-33248no fix yetNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersCVE-2026-33246no fix yetNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingCVE-2026-33223no fix yetNATS JetStream has an authorization bypass through its Management APICVE-2026-33222no fix yetNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219no fix yetNATS has pre-auth server panic via leafnode handlingCVE-2026-33218no fix yet