CVE-2026-33246: NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers. NATS messages can have headers.
Problem Description
The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker.
A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked.
Thus NATS clients relying upon the Nats-Request-Info: header could be spoofed.
Does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
None.
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33246?
The severity of CVE-2026-33246 has not been assigned a specific CVSS score but it poses a risk to NATS server installations.
How do I fix CVE-2026-33246?
To fix CVE-2026-33246, you should upgrade to NATS server version 2.12.6 or later, or to version 2.11.15 if currently using a prior version.
What vulnerabilities are associated with CVE-2026-33246?
CVE-2026-33246 primarily affects the NATS server's handling of leafnode connections leading to potential security issues.
Which versions of NATS server are affected by CVE-2026-33246?
Versions of the NATS server from 2.12.0-RC.1 up to and including 2.12.6 and any versions before 2.11.15 are affected by CVE-2026-33246.
Is it safe to use NATS server below version 2.11.15 following CVE-2026-33246?
No, using NATS server versions below 2.11.15 is not safe due to potential vulnerabilities present in those versions related to CVE-2026-33246.