nats-serverGHSA-jxxm-27vp-c3m5
NATS allows MQTT clients to bypass ACL checks
High7.1CVE-2026-33217 · Published Mar 24, 2026 · updated Sep 10, 2026
### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT client interface. ### Problem Description When using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds None.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/nats-io/nats-server Go | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- BIT-nats-2026-33217, CVE-2026-33217, GO-2026-4834
More nats-server advisories
All nats-server| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 24 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching Medium4.2Mar 24 | Medium4.2 | No fix yet |
| Mar 24 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersMedium6.4Mar 24 | Medium6.4 | No fix yet |
| Mar 24 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingMedium6.4Mar 24 | Medium6.4 | No fix yet |
| Mar 24 | NATS JetStream has an authorization bypass through its Management APIMedium4.9Mar 24 | Medium4.9 | No fix yet |
| Mar 24 | NATS is vulnerable to pre-auth DoS through WebSockets client serviceMedium5.3Mar 24 | Medium5.3 | No fix yet |
| Mar 24 | NATS has pre-auth server panic via leafnode handlingHigh7.5Mar 24 | High7.5 | No fix yet |