BIT-nats-2026-33215

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/nats/BIT-nats-2026-33215.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-nats-2026-33215

Aliases

Published

2026-03-27T07:08:53.339Z

Modified

2026-03-27T12:31:18.251912Z

Summary

NATS is vulnerable to MQTT hijacking via Client ID

Details

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

Database specific

{
    "cpes": [
        "cpe:2.3:a:nats:nats_server:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / nats

Package

Name: nats
Purl: pkg:bitnami/nats

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.11.15

Introduced

2.12.0

Fixed

2.12.6

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/nats/BIT-nats-2026-33215.json"