CVE-2026-33216: NATS-Server plaintext password disclosure in monitoring endpoints

CVE-2026-33216 · Severity: high · CVSS 8.6 · Published 2026-03-25

NATS-Server is a high-performance messaging system used for cloud and IoT communications. A security flaw in certain versions allows MQTT user passwords to be accidentally exposed in plaintext through the server's monitoring interface. If an attacker accesses this interface, they could steal credentials, potentially leading to unauthorized access to the messaging network and sensitive data.

Technologies: github.com/nats-io/nats-server (Go), github.com/nats-io/nats-server/v2 (Go), Red Hat Multicluster Global Hub. Vendors: Go, Red Hat.

Quick answers

Is CVE-2026-33216 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33216 being exploited in the wild.
How severe is CVE-2026-33216?
High severity, with a CVSS score of 8.6, published 25 March 2026.
Which products and versions are affected?
github.com/nats-io/nats-server (Go) SEMVER:introduced=0; github.com/nats-io/nats-server/v2 (Go) SEMVER:introduced=0,fixed=2.11.15, SEMVER:introduced=0,fixed=2.11.15,introduced=2.12.0-RC.1,fixed=2.12.6; Red Hat Multicluster Global Hub 1.4.5.
Is there a fix for CVE-2026-33216?
Yes. github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33216 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33216?
Check whether you run github.com/nats-io/nats-server (Go), github.com/nats-io/nats-server/v2 (Go) or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later
    go get github.com/nats-io/nats-server/v2@v2.12.6

Technical details

A vulnerability exists in NATS-Server where MQTT passwords are incorrectly handled during authentication processing. Specifically, the server misclassifies these passwords as non-authenticating JSON Web Token (JWT) identity statements, causing them to be included in data served by monitoring endpoints. An unauthenticated attacker with network access to the monitoring port can retrieve these plaintext credentials without any user interaction. This issue affects MQTT deployments using usercode/password authentication in versions prior to 2.11.15 and 2.12.6. Patches are available in versions 2.11.15 and 2.12.6; as a workaround, administrators should restrict access to monitoring endpoints.

Affected products

  • nats-io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6
  • Red Hat Multicluster Global Hub 1.4.5 1.4.5
  • Red Hat Multicluster Global Hub 1.5.4 1.5.4
  • Red Hat Multicluster Global Hub 1.6.2 1.6.2

Identifiers

  • CVE-2026-33216
  • GHSA-v722-jcv5-w7mc
  • GO-2026-4836

Timeline

  • 2026-03-24: disclosed: Initial disclosure by NATS.io and GitHub advisory publication.
  • 2026-03-24: patched: Fixes released in versions 2.11.15 and 2.12.6.
  • 2026-03-25: advisory: CVE-2026-33216 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.