Junglewise Threat Intelligence

CVE-2026-33216: NATS-Server plaintext password disclosure in monitoring endpoints

CVE-2026-33216 · Severity: high · CVSS 8.6 · Published 2026-03-25

Technologies: github.com/nats-io/nats-server/v2 (Go), Nats-Io NATS Server, github.com/nats-io/nats-server (Go), Red Hat Multicluster Global Hub. Vendors: Red Hat, Go.

Executive brief

NATS-Server is a high-performance messaging system used for cloud and IoT communications. A security flaw in certain versions allows MQTT user passwords to be accidentally exposed in plaintext through the server's monitoring interface. If an attacker accesses this interface, they could steal credentials, potentially leading to unauthorized access to the messaging network and sensitive data.

Technical details

A vulnerability exists in NATS-Server where MQTT passwords are incorrectly handled during authentication processing. Specifically, the server misclassifies these passwords as non-authenticating JSON Web Token (JWT) identity statements, causing them to be included in data served by monitoring endpoints. An unauthenticated attacker with network access to the monitoring port can retrieve these plaintext credentials without any user interaction. This issue affects MQTT deployments using usercode/password authentication in versions prior to 2.11.15 and 2.12.6. Patches are available in versions 2.11.15 and 2.12.6; as a workaround, administrators should restrict access to monitoring endpoints.

Affected products

  • nats-io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6
  • Red Hat Multicluster Global Hub 1.4.5 1.4.5
  • Red Hat Multicluster Global Hub 1.5.4 1.5.4
  • Red Hat Multicluster Global Hub 1.6.2 1.6.2

Timeline

  • 2026-03-24: disclosed: Initial disclosure by NATS.io and GitHub advisory publication.
  • 2026-03-24: patched: Fixes released in versions 2.11.15 and 2.12.6.
  • 2026-03-25: advisory: CVE-2026-33216 published.

References

Related threats