nats-serverGHSA-v722-jcv5-w7mc
NATS has MQTT plaintext password disclosure
High8.6CVE-2026-33216 · Published Mar 24, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/nats-io/nats-server Go | all versions | No fix yet |
Details and references
### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT client interface. ### Problem Description For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds Ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-256
- Also known as
- BIT-nats-2026-33216, CVE-2026-33216, GO-2026-4836
More nats-server advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 24 | NATS Server panic via malicious compression on leafnode port CVE-2026-29785High7.5no fix yet | High7.5 | No fix yet |
| Mar 24 | NATS allows MQTT clients to bypass ACL checks CVE-2026-33217High7.1no fix yet | High7.1 | No fix yet |
| Mar 24 | NATS has pre-auth server panic via leafnode handling CVE-2026-33218High7.5no fix yet | High7.5 | No fix yet |
| Mar 24 | NATS is vulnerable to pre-auth DoS through WebSockets client service CVE-2026-33219Medium5.3no fix yet | Medium5.3 | No fix yet |
| Mar 24 | NATS JetStream has an authorization bypass through its Management API CVE-2026-33222Medium4.9no fix yet | Medium4.9 | No fix yet |
| Mar 24 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing CVE-2026-33223Medium6.4no fix yet | Medium6.4 | No fix yet |