CVE-2026-33217: NATS allows MQTT clients to bypass ACL checks
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
Problem Description
When using ACLs on message subjects, these ACLs were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
None.
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.12.6 - Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
nats-server (NATS.io)to a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
nats-server (NATS.io)to a version that resolves this vulnerability.Fixed in 2.12.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33217?
The severity of CVE-2026-33217 is classified as high due to improper handling of ACLs on message subjects.
How do I fix CVE-2026-33217?
To fix CVE-2026-33217, upgrade nats-server to version 2.12.6 or later, or to version 2.11.15 if using an earlier version.
Which versions of nats-server are affected by CVE-2026-33217?
CVE-2026-33217 affects nats-server versions between 2.12.0-RC.1 and 2.12.6, as well as versions up to 2.11.15.
What is the impact of CVE-2026-33217?
CVE-2026-33217 can lead to unauthorized access to message subjects due to improper ACL enforcement.
Is there a workaround for CVE-2026-33217?
There is no known workaround for CVE-2026-33217, so upgrading to the recommended versions is essential.