CVE-2026-33216: NATS has MQTT plaintext password disclosure
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
Problem Description
For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
Ensure monitoring end-points are adequately secured.
Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
Other sources
NATS has MQTT plaintext password disclosure
— Microsoft
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.12.6 - Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
NATS-Server (nats-server)to a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
NATS-Server (nats-server)to a version that resolves this vulnerability.Fixed in 2.12.6 - Compensating control
Do not expose the monitoring endpoint to the Internet or other untrusted network users; ensure monitoring endpoints are adequately secured for MQTT deployments affected by pre-2.11.15/2.12.6.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33216?
CVE-2026-33216 has a high severity rating, indicating significant risk to systems utilizing vulnerable versions.
How do I fix CVE-2026-33216?
To remediate CVE-2026-33216, upgrade nats-server to version 2.12.6 or later, or to version 2.11.15.
Which versions of nats-server are affected by CVE-2026-33216?
CVE-2026-33216 affects nats-server versions from 2.12.0-RC.1 up to 2.12.6 and all versions prior to 2.11.15.
What impact does CVE-2026-33216 have on MQTT deployments?
CVE-2026-33216 impacts MQTT deployments that use usercodes/passwords, potentially exposing credentials.
Is CVE-2026-33216 related to NATS.io's security model?
Yes, CVE-2026-33216 highlights a weakness in NATS.io's security model for MQTT, particularly concerning authentication.