PT-2026-27617 · Nats.Io · Nats Server

Published 2026-03-24 · Updated 2026-05-21 · CVE-2026-33222

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server, a high-performance server for NATS.io, contains an issue where users with JetStream admin API access to restore one stream could restore to other stream names. This could impact data that should have been protected from unauthorized access. The JetStream management API, which includes backup and restore functionality, is affected.

Recommendations Update to version 2.11.15 or later. Update to version 2.12.6 or later. If limited JetStream restore permissions are configured for users, temporarily remove those permissions.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-NATS-2026-33222

CVE-2026-33222

GHSA-9983-VRX2-FG9C

GO-2026-4832

SUSE-SU-2026:1135-1

Affected Products

Nats Server

References · 156

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33222.json · Exploit
• https://github.com/nats-io/nats-server/security/advisories/GHSA-9983-vrx2-fg9c · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nats-2026-33222 · Vendor Advisory
• https://advisories.nats.io/CVE/secnote-2026-12.txt · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33222 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33222 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33222 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33222 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-33222 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4832 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9983-vrx2-fg9c · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33222 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33222 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33222 · Vendor Advisory