Junglewise Threat Intelligence

CVE-2026-33247: NATS-Server sensitive information disclosure in monitoring endpoint

CVE-2026-33247 · Severity: high · CVSS 7.4 · Published 2026-03-25

Technologies: NATS.io NATS Server, github.com/nats-io/nats-server/v2 (Go), github.com/nats-io/nats-server (Go), Red Hat Multicluster Global Hub. Vendors: Go, Red Hat.

Executive brief

NATS-Server is a high-performance messaging system used for cloud and edge computing. A security flaw allows sensitive login credentials to be exposed to anyone who can access the server's monitoring interface. If an attacker obtains these credentials, they could gain unauthorized access to the messaging network, potentially intercepting or tampering with business-critical data.

Technical details

NATS-Server is vulnerable to sensitive information disclosure when run with static credentials provided via command-line arguments (argv). The server's monitoring interface, specifically the `/debug/vars` endpoint, contains an unredacted copy of these arguments. An attacker with network access to the monitoring port can retrieve these credentials without authentication. This affects nats-server versions prior to 2.11.15 and 2.12.6. Remediation involves upgrading to patched versions or migrating credentials from command-line arguments to a secure configuration file.

Affected products

  • NATS.io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6
  • Red Hat Multicluster Global Hub 1.4.5, 1.5.4, 1.6.2

Timeline

  • 2026-03-24: advisory: NATS maintainers published security advisory 2026-14
  • 2026-03-25: disclosed: CVE-2026-33247 published to NVD
  • 2026-05-28: patched: Red Hat released security updates for Multicluster Global Hub

References

Related threats