CVE-2026-33222mediumCWE-285

CVE-2026-33222: fallo de gravedad media en nats-io nats-server

NATS JetStream has an authorization bypass through its Management API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear nats-server+ Monitorear nats-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.9epss 0.3%
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Productos afectados
nats-io · nats-server
CVEs relacionadas — nats-io nats-server

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-58210HIGHNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memoryEPSS 0.7%CVE-2026-58250HIGHNATS Server: Pre-auth server crash via double INFO in leafnode handshakeEPSS 0.7%CVE-2026-29785HIGHNATS Server panic via malicious compression on leafnode portEPSS 0.7%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.6%CVE-2025-30215CRITICALNATS-Server Fails to Authorize Certain Jetstream Admin APIsEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%