7.4
Élevée
CVE-2026-33247 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials are visible to any user who can see the monitoring port, if that too is enabled. The `/debug/vars` end-point contains an unredacted copy of argv. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| nats-server 2.12 | 2.12.0-RC.1 → < 2.12.6 | 2.12.6 |
| nats-server 2.11 | premières → < 2.11.15 | 2.11.15 |
| Multicluster Global Hub 1.4.5 1779579439 | premières → < 1779579439 | 1779579439 |
| Multicluster Global Hub 1.5.4 1778867753 | premières → < 1778867753 | 1778867753 |
| Multicluster Global Hub 1.6.2 1780167118 | premières → < 1780167118 | 1780167118 |
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat multicluster global hub 1.4.3 1779579439 | premières → < 1779579439 | 1779579439 |
| Red Hat multicluster global hub 1.5.2 1778867753 | premières → < 1778867753 | 1778867753 |
| Red Hat multicluster global hub 1.4.4 1779579439 | premières → < 1779579439 | 1779579439 |
Afficher les 8 autres branches Masquer les 8 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat multicluster global hub 1.6.0 1780167118 | premières → < 1780167118 | 1780167118 |
| Red Hat multicluster global hub 1.5.0 1778867753 | premières → < 1778867753 | 1778867753 |
| Multicluster Global Hub 1.5.7 1778867753 | premières → < 1778867753 | 1778867753 |
| Multicluster Global Hub 1.6.5 1780167118 | premières → < 1780167118 | 1780167118 |
| Red Hat multicluster global hub 1.4.2 1779579439 | premières → < 1779579439 | 1779579439 |
| Multicluster Global Hub 1.5.6 1778867753 | premières → < 1778867753 | 1778867753 |
| Red Hat multicluster global hub 1.5.1 1778867753 | premières → < 1778867753 | 1778867753 |
| Red Hat multicluster global hub 1.5.3 1778867753 | premières → < 1778867753 | 1778867753 |
Références
- github.com github.com
- advisories.nats.io advisories.nats.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de nats-server
Les 27 CVE de nats-server →
CVE-2026-58208
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system
6.8
Moyenne
CVE-2026-58211
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system
5.4
Moyenne
CVE-2026-58207
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system
7.7
Élevée
CVE-2026-58210
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system
7.5
Élevée