CVE-2026-33249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33249", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T02:42:27.509Z", "datePublished": "2026-03-25T20:21:30.156Z", "dateUpdated": "2026-03-26T19:52:12.206Z"}, "containers": {"cna": {"title": "NATS: Message tracing can be redirected to arbitrary subject", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j"}, {"name": "https://advisories.nats.io/CVE/secnote-2026-15.txt", "tags": ["x_refsource_MISC"], "url": "https://advisories.nats.io/CVE/secnote-2026-15.txt"}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"version": ">= 2.11.0, < 2.11.15", "status": "affected"}, {"version": ">= 2.12.0-preview.1, < 2.12.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T20:21:30.156Z"}, "descriptions": [{"lang": "en", "value": "NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available."}], "source": {"advisory": "GHSA-8m2x-3m6q-6w8j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33249", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:36:51.837783Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:52:12.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33249", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:36:51.837783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:51:06.457Z"}}], "cna": {"title": "NATS: Message tracing can be redirected to arbitrary subject", "source": {"advisory": "GHSA-8m2x-3m6q-6w8j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": ">= 2.11.0, < 2.11.15"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.6"}]}], "references": [{"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j", "name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://advisories.nats.io/CVE/secnote-2026-15.txt", "name": "https://advisories.nats.io/CVE/secnote-2026-15.txt", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T20:21:30.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33249", "state": "PUBLISHED", "dateUpdated": "2026-03-26T19:52:12.206Z", "dateReserved": "2026-03-18T02:42:27.509Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T20:21:30.156Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nats-server", "vendor": "nats-io", "versions": [{"status": "affected", "version": ">= 2.11.0, < 2.11.15"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "04A14239-FB32-4FD3-8B45-BDE015A7F721", "versionEndExcluding": "2.11.15", "versionStartIncluding": "2.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E347CFB-C56D-4FD8-8DD8-3D34C08D7154", "versionEndExcluding": "2.12.6", "versionStartIncluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available."}, {"lang": "es", "value": "NATS-Server es un servidor de alto rendimiento para NATS.io, un sistema de mensajer\u00eda nativo de la nube y del borde. A partir de la versi\u00f3n 2.11.0 y antes de las versiones 2.11.15 y 2.12.6, un cliente v\u00e1lido que utiliza encabezados de rastreo de mensajes puede indicar que los mensajes de rastreo pueden enviarse a un asunto v\u00e1lido arbitrario, incluidos aquellos para los que el cliente no tiene permiso de publicaci\u00f3n. La carga \u00fatil es un mensaje de rastreo v\u00e1lido y no es elegido por el atacante. Las versiones 2.11.15 y 2.12.6 contienen una correcci\u00f3n. No hay soluciones alternativas conocidas disponibles."}], "id": "CVE-2026-33249", "lastModified": "2026-06-17T10:37:11.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33249", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T19:36:51.837783Z", "version": "2.0.3"}}]}, "published": "2026-03-25T21:16:47.737", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://advisories.nats.io/CVE/secnote-2026-15.txt"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/nats-io/nats-server: NATS-Server: Unauthorized trace message redirection via message tracing headers", "id": "2451485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451485"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-1220", "details": ["A flaw was found in NATS-Server. A valid client can exploit this flaw by manipulating message tracing headers to redirect trace messages to any valid subject, even those for which the client lacks publish permissions. This allows for unauthorized sending of trace messages, potentially bypassing intended access controls and leading to information misdirection within the NATS.io messaging system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-33249", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/oc-mirror-plugin-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-03-25T20:21:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33249\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33249\nhttps://advisories.nats.io/CVE/secnote-2026-15.txt\nhttps://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.11.0,2.11.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0-preview.1,2.12.6)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "nats-server", "source": "cna", "vendor": "nats-io"}, "product": "nats_server", "vendor": "nats"}], "analysis": {"en": {"generated_at": "2026-03-26T17:29:04.273503+00:00", "value": {"mitigation_remediation": ["Upgrade NATS\u2011Io Server to version 2.11.15, 2.12.6, or later.", "If an upgrade is pending, disable message tracing headers on clients or configure the server to reject trace messages with arbitrary subject redirection."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized publication of trace messages to disallowed subjects"}, "threat_synthesis": {"affected_systems": "NATS\u2011Io Server is affected. Versions 2.11.0 through 2.11.14 and 2.12.0 through 2.12.5 allow the issue; releases 2.11.15 and 2.12.6 and later include a fix.", "description_and_impact": "When a client uses message tracing headers, the server treats the trace messages as normal messages and publishes them to the subject specified in the header, even if the client lacks permission to publish there. The attacker cannot choose the payload, but can force the server to expose trace data on otherwise protected subjects, potentially leaking sensitive information or violating access controls.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity while the EPSS score below 1\u202f% suggests low exploit probability. The vulnerability is not listed in the KEV catalog. An attacker must have a legitimate NATS client connection with tracing enabled; after that, the server can be coerced into publishing trace messages to arbitrary subjects. No privileged escalation beyond the client\u2019s own permissions is required."}}}}, "created": "2026-03-26T11:31:42.685608+00:00", "updated": "2026-03-27T09:29:43.960802+00:00", "vendors": ["nats", "nats$PRODUCT$nats_server"]}