PT-2026-27620 · Nats.Io · Nats Server

Published 2026-03-24 · Updated 2026-05-21 · CVE-2026-33247

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server is a high-performance server for NATS.io, a cloud and edge native messaging system. If a nats-server is run with static credentials for all clients provided via command-line arguments (argv), those credentials are visible to any user who can access the monitoring port if it is enabled. The /debug/vars API endpoint contains an unredacted copy of argv. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.

Recommendations Update to NATS-Server version 2.11.15 or later. Update to NATS-Server version 2.12.6 or later. Configure credentials inside a configuration file instead of via argv. Do not enable the monitoring port if using secrets in argv. Do not expose the monitoring port to the Internet or untrusted network sources.

Exploit

Fix

Weakness Enumeration

CWE-215

Related Identifiers

BIT-NATS-2026-33247

CVE-2026-33247

GHSA-X6G4-F6Q3-FQVV

GO-2026-4827

SUSE-SU-2026:1135-1

Affected Products

Nats Server

References · 157

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33247.json · Exploit
• https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4827 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33247 · Vendor Advisory
• https://advisories.nats.io/CVE/secnote-2026-14.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33247 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33247 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33247 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x6g4-f6q3-fqvv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33247 · Security Note
• https://osv.dev/vulnerability/BIT-nats-2026-33247 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-33247 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33247 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33247 · Vendor Advisory