AZL-81636

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-81636.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-81636

Upstream

CVE-2026-33216

Published

2026-03-25T20:16:32Z

Modified

2026-09-20T05:33:47Z

Summary

CVE-2026-33216 affecting package telegraf for versions less than 1.31.0-19

Details

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33216

Affected packages

Azure Linux:3 / telegraf

Package

Name: telegraf
Purl: pkg:rpm/azure-linux/telegraf

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.31.0-19

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-81636.json"