nats-serverGO-2026-4827
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server
UnratedCVE-2026-33247 · Published Mar 26, 2026 · updated Mar 27, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/nats-io/nats-server Go | all versions | No fix yet |
Details and references
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server
- Severity from
- no source yet
- Also known as
- BIT-nats-2026-33247, CVE-2026-33247, GHSA-x6g4-f6q3-fqvv
More nats-server advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 25 | NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVE-2026-27889High7.5no fix yet | High7.5 | No fix yet |
| Mar 26 | NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server CVE-2026-33249Unratedno fix yet | Unrated | No fix yet |
| Mar 26 | NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server CVE-2026-33215Unratedno fix yet | Unrated | No fix yet |
| Mar 24 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching CVE-2026-33248Medium4.2no fix yet | Medium4.2 | No fix yet |
| Mar 24 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers CVE-2026-33246Medium6.4no fix yet | Medium6.4 | No fix yet |
| Mar 24 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing CVE-2026-33223Medium6.4no fix yet | Medium6.4 | No fix yet |