GHSA-v722-jcv5-w7mc

NATS has MQTT plaintext password disclosure

Source: GitHub Advisory Database (reviewed) High CVE-2026-33216

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/nats-io/nats-server/v2	< 2.11.15	2.11.15
Go	github.com/nats-io/nats-server/v2	>= 2.12.0-RC.1, < 2.12.6	2.12.6
Go	github.com/nats-io/nats-server	all versions	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT client interface. ### Problem Description For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds Ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

References

External links from the advisory. They lead to third-party sites.