CVE-2026-33249: NATS: Message tracing can be redirected to arbitrary subject
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server supports telemetry on messages, using the per-message NATS headers.
Problem Description
A valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission.
The payload is a valid trace message and not chosen by the attacker.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
None.
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33249?
CVE-2026-33249 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-33249?
To mitigate CVE-2026-33249, upgrade to nats-server version 2.12.6 or 2.11.15.
What causes CVE-2026-33249?
CVE-2026-33249 is caused by a valid client being able to send trace messages to subjects without having the necessary publish permissions.
What is affected by CVE-2026-33249?
CVE-2026-33249 affects nats-server versions between 2.12.0-preview.1 to 2.12.6 and 2.11.0 to 2.11.15.
Can CVE-2026-33249 be exploited remotely?
Yes, CVE-2026-33249 can potentially be exploited remotely by any valid client that uses message tracing headers.