What’s Vulnerable › Vulnerabilities

CVE-2026-33215: NATS is vulnerable to MQTT hijacking via Client ID

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-287

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

Affected products

• nats-io nats-server: from 2.0.0 before 2.11.15; from 2.12.0 before 2.12.5 — fixed in 2.11.15, 2.12.5

How to fix

Upgrade to a fixed version: nats-io nats-server 2.11.15, 2.12.5. Check the vendor advisory for mitigations.

References

• https://advisories.nats.io/CVE/secnote-2026-06.tx
• https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879

Get alerted when CVE-2026-33215 or the next vulnerability affects your stack