Skip to content
fr Sign in
7.4 High

CVE-2026-33247 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials are visible to any user who can see the monitoring port, if that too is enabled. The `/debug/vars` end-point contains an unredacted copy of argv. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.

Affected products and versions

Product Affected versions Fixed in
nats-server 2.12 2.12.0-RC.1 → < 2.12.6 2.12.6
nats-server 2.11 earliest → < 2.11.15 2.11.15
Multicluster Global Hub 1.4.5 1779579439 earliest → < 1779579439 1779579439
Multicluster Global Hub 1.5.4 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.6.2 1780167118 earliest → < 1780167118 1780167118
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat multicluster global hub 1.4.3 1779579439 earliest → < 1779579439 1779579439
Red Hat multicluster global hub 1.5.2 1778867753 earliest → < 1778867753 1778867753
Red Hat multicluster global hub 1.4.4 1779579439 earliest → < 1779579439 1779579439
Show the 8 other branches
Product Affected versions Fixed in
Red Hat multicluster global hub 1.6.0 1780167118 earliest → < 1780167118 1780167118
Red Hat multicluster global hub 1.5.0 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.5.7 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.6.5 1780167118 earliest → < 1780167118 1780167118
Red Hat multicluster global hub 1.4.2 1779579439 earliest → < 1779579439 1779579439
Multicluster Global Hub 1.5.6 1778867753 earliest → < 1778867753 1778867753
Red Hat multicluster global hub 1.5.1 1778867753 earliest → < 1778867753 1778867753
Red Hat multicluster global hub 1.5.3 1778867753 earliest → < 1778867753 1778867753

References

Timeline

  1. Published
  2. Last modified

Other CVEs of nats-server

The 27 CVEs of nats-server →
CVE-2026-58208 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 6.8 Medium CVE-2026-58211 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 5.4 Medium CVE-2026-58207 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 7.7 High CVE-2026-58210 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 7.5 High
Track this CVE