GHSA-fcjp-h8cc-6879

NATS is vulnerable to MQTT hijacking via Client ID

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33215

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/nats-io/nats-server/v2	< 2.11.15	2.11.15
Go	github.com/nats-io/nats-server/v2	>= 2.12.0-RC.1, < 2.12.6	2.12.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT client interface. ### Problem Description Sessions and Messages can by hijacked via MQTT Client ID malfeasance. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds None. ### Resources * This document is canonically: <https://advisories.nats.io/CVE/secnote-2026-06.txt> * GHSA advisory: <https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879> * MITRE CVE entry: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33215>

References

External links from the advisory. They lead to third-party sites.