CVE-2026-33217
ACL Bypass in NATS-Server MQTT Namespace Allows Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-03-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | nats-server | From 2.12.0 (inc) to 2.12.6 (exc) |
| linuxfoundation | nats-server | to 2.11.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows MQTT clients to bypass Access Control Lists (ACLs) within the $MQTT.> namespace, potentially enabling unauthorized modification of data.
Such unauthorized data integrity compromises could impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of data integrity.
However, the vulnerability has a low confidentiality impact and no availability impact, meaning data exposure and service disruption risks are limited.
Organizations using affected versions of nats-server should update to fixed versions to maintain compliance with these regulations by ensuring proper enforcement of access controls.
Can you explain this vulnerability to me?
CVE-2026-33217 is a security vulnerability in the nats-server component of NATS.io, a high-performance messaging system used in cloud, on-premise, IoT, and edge computing environments.
The vulnerability occurs because Access Control Lists (ACLs) that are supposed to restrict access to message subjects do not work properly within the $MQTT.> namespace. This means MQTT clients can bypass these ACL checks and gain unauthorized access to MQTT message subjects.
This flaw affects all nats-server versions prior to 2.11.15 and 2.12.6, where the issue was fixed. There are no known workarounds.
How can this vulnerability impact me? :
This vulnerability allows attackers with low privileges to remotely bypass ACLs in the MQTT namespace.
As a result, unauthorized users could access or publish messages they should not be able to, leading to potential unauthorized modification of data (high integrity impact).
While the confidentiality impact is low and availability is not affected, the integrity compromise could lead to significant security risks in systems relying on NATS for messaging.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your nats-server to version 2.11.15 or 2.12.6 or later, as these versions contain the fix for the ACL bypass issue in the $MQTT.> namespace.
No known workarounds are available, so upgrading is the primary and immediate step to secure your system.