What’s Vulnerable › Vulnerabilities

CVE-2026-33222: NATS JetStream has an authorization bypass through its Management API

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-25 · updated 2026-06-17
• Weakness: CWE-285

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.

Affected products

• nats-io nats-server: before 2.11.15; from 2.12.0 before 2.12.6 — fixed in 2.11.15, 2.12.6

How to fix

Upgrade to a fixed version: nats-io nats-server 2.11.15, 2.12.6. Check the vendor advisory for mitigations.

References

• https://advisories.nats.io/CVE/secnote-2026-12.txt
• https://github.com/nats-io/nats-server/security/advisories/GHSA-9983-vrx2-fg9c

Get alerted when CVE-2026-33222 or the next vulnerability affects your stack