Cloudanix VulnDB

CVE-2026-33215

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Mar 24, 2026

CISA due date

—

The record

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard k3s 0 1.35.2.1-r4
Chainguard k3s-1.32 0 1.32.13.1-r7
Chainguard k3s-1.33 0 1.33.9.1-r6
Chainguard k3s-static 0 1.35.2.1-r4
Chainguard k3s-static-1.32 0 1.32.13.1-r7
Chainguard k3s-static-1.33 0 1.33.9.1-r6
Chainguard kine 0 0.14.15-r1
Chainguard milvus-2.5 0 2.5.27-r4
Chainguard nats 0 0.3.2-r0
Chainguard nats-fips 0 0.3.2-r0
Chainguard nats-top 0 0.6.3-r18
Chainguard nats-top-fips 0 0.6.3-r16
Chainguard prometheus-nats-exporter 0 0.19.1-r4
Chainguard prometheus-nats-exporter-fips 0 0.19.1-r4
Chainguard rke2-runtime-1.33 0 1.33.9.2.1-r3
Chainguard rke2-runtime-1.34 0 1.34.5.2.1-r3
Chainguard rke2-runtime-1.35 0 1.35.2.2.1-r3
Chainguard rke2-runtime-fips-1.34 0 1.34.6.2.1-r2
Chainguard rke2-runtime-fips-1.35 0 1.35.2.2.1-r2
Chainguard telegraf-1.37 0 1.37.3-r6
Chainguard telegraf-1.38 0 1.38.1-r1
Wolfi k3s 0 1.35.2.1-r4
Wolfi k3s-1.32 0 1.32.13.1-r7
Wolfi k3s-1.33 0 1.33.9.1-r6
Wolfi k3s-static 0 1.35.2.1-r4
Wolfi k3s-static-1.32 0 1.32.13.1-r7
Wolfi k3s-static-1.33 0 1.33.9.1-r6
Wolfi kine 0 0.14.15-r1
Wolfi nats 0 0.3.2-r0
Wolfi nats-top 0 0.6.3-r18
Wolfi prometheus-nats-exporter 0 0.19.1-r4
Wolfi telegraf-1.37 0 1.37.3-r6
Wolfi telegraf-1.38 0 1.38.1-r1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2

Related vulnerabilities