CVE-2026-33217: NATS-Server ACL bypass in MQTT namespace

CVE-2026-33217 · Severity: high · CVSS 7.1 · Published 2026-03-25

NATS-Server is a high-performance messaging system used for cloud and IoT communications. A security flaw was identified where access control rules (ACLs) were not properly enforced for clients using the MQTT protocol. This could allow an authenticated user to bypass security restrictions and publish or receive messages they are not authorized to access, potentially leading to unauthorized data modification or information disclosure.

Technologies: github.com/nats-io/nats-server (Go), github.com/nats-io/nats-server/v2 (Go), Red Hat Multicluster Global Hub. Vendors: Go, Red Hat.

Quick answers

Is CVE-2026-33217 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33217 being exploited in the wild.
How severe is CVE-2026-33217?
High severity, with a CVSS score of 7.1, published 25 March 2026.
Which products and versions are affected?
github.com/nats-io/nats-server (Go) SEMVER:introduced=0; github.com/nats-io/nats-server/v2 (Go) SEMVER:introduced=0,fixed=2.11.15, SEMVER:introduced=0,fixed=2.11.15,introduced=2.12.0-RC.1,fixed=2.12.6; Red Hat Multicluster Global Hub 1.4.5, 1.5.4, 1.6.2.
Is there a fix for CVE-2026-33217?
Yes. github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33217 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33217?
Check whether you run github.com/nats-io/nats-server (Go), github.com/nats-io/nats-server/v2 (Go) or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later
    go get github.com/nats-io/nats-server/v2@v2.12.6

Technical details

A vulnerability in NATS-Server's MQTT implementation involves incorrect authorization (CWE-863) when processing message subjects. Specifically, ACLs defined for message subjects were not applied within the '$MQTT.>' namespace. A remote attacker with valid MQTT credentials could exploit this to bypass intended subject-based access restrictions, enabling unauthorized publishing or subscribing to restricted topics. The issue is resolved in NATS-Server versions 2.11.15 and 2.12.6. Red Hat has also released updates for Multicluster Global Hub to address this vulnerability.

Affected products

  • nats-io nats-server < 2.11.15, >= 2.12.0-RC.1, < 2.12.6
  • Red Hat Multicluster Global Hub 1.4.5, 1.5.4, 1.6.2

Identifiers

  • CVE-2026-33217
  • GHSA-jxxm-27vp-c3m5
  • GO-2026-4834

Timeline

  • 2026-03-24: advisory: Vendor advisory published by NATS.io
  • 2026-03-25: disclosed: CVE published to NVD
  • 2026-05-28: patched: Red Hat released security updates for Multicluster Global Hub 1.5.4
  • 2026-06-01: patched: Red Hat released security updates for Multicluster Global Hub 1.4.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.