CVE-2026-33215

NATS is vulnerable to MQTT hijacking via Client ID

State: Published
Severity: 6.5 Medium
Published: Mar 24, 2026
Updated: Mar 25, 2026
Reserved: Mar 17, 2026

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L	GitHub_M

Weaknesses

CWE-287 Improper Authentication
CWE-488 Exposure of Data Element to Wrong Session

Affected Products

Product	Versions
nats-servernats-io	< 2.11.15Affected >= 2.12.0-RC.1, < 2.12.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.