CVE-2026-33215 MEDIUM

CVE-2026-33215: NATS is vulnerable to MQTT hijacking via Client ID

Vendor Nats-Io
Product nats-server
Weakness CWE-287 · Improper authentication
Published March 24, 2026
Last update March 25, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

What the vulnerability does

01Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

Key dates

02Disclosure timeline

March 24, 2026 CVE published
March 25, 2026 Record updated