CVE-2026-33249 - NATS: Message tracing can be redirected to arbitrary subject

Back Back to CVE browser

MEDIUM

NATS: Message tracing can be redirected to arbitrary subject

Published Mar 25, 2026

6.4

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

Affected products

Vendor Nats-IO Product Nats-Server Default
n/a
- Version
  >= 2.11.0, < 2.11.15
  Status
  affected
  Constraints
  -
- Version
  >= 2.12.0-preview.1, < 2.12.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nats-IO

Nats-Server

n/a

Version	Status	Constraints
>= 2.11.0, < 2.11.15	affected	-
>= 2.12.0-preview.1, < 2.12.6	affected	-

Multicluster Global Hub

multicluster-globalhub/multicluster-globalhub-grafana-rhel9

Fix deferred
Red Hat OpenShift Container Platform 4

openshift4/oc-mirror-plugin-rhel9

Fix deferred

Product	Package	State	Advisory
Multicluster Global Hub	multicluster-globalhub/multicluster-globalhub-grafana-rhel9	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	openshift4/oc-mirror-plugin-rhel9	Fix deferred	n/a

github.com/nats-io/nats-server/v2

Go

Introduced 2.11.0 Fixed 2.11.15
github.com/nats-io/nats-server/v2

Go

Introduced 2.12.0-preview.1 Fixed 2.12.6
github.com/nats-io/nats-server

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	github.com/nats-io/nats-server/v2	2.11.0	2.11.15
Go	github.com/nats-io/nats-server/v2	2.12.0-preview.1	2.12.6
Go	github.com/nats-io/nats-server	0	not fixed

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (2)

CWE-1220

CWE-863

Incorrect Authorization

References (7)

https://access.redhat.com/security/cve/CVE-2026-33249
Vendor Advisory
https://advisories.nats.io/CVE/secnote-2026-15.txt
x_refsource_MISCVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451485
Issue Tracking
https://github.com/advisories/GHSA-8m2x-3m6q-6w8j
Advisory
https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33249
https://www.cve.org/CVERecord?id=CVE-2026-33249

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-33249		Vendor Advisory
https://advisories.nats.io/CVE/secnote-2026-15.txt		x_refsource_MISCVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451485		Issue Tracking
https://github.com/advisories/GHSA-8m2x-3m6q-6w8j		Advisory
https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33249
https://www.cve.org/CVERecord?id=CVE-2026-33249