Cloudanix VulnDB

CVE-2026-33216

High · 8.6

CVSS

8.6

EPSS

0.7%

Published

Mar 25, 2026

CISA due date

—

The record

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard k3s 0 1.35.2.1-r4
Chainguard k3s-1.32 0 1.32.13.1-r7
Chainguard k3s-1.33 0 1.33.9.1-r6
Chainguard k3s-static 0 1.35.2.1-r4
Chainguard k3s-static-1.32 0 1.32.13.1-r7
Chainguard k3s-static-1.33 0 1.33.9.1-r6
Chainguard kine 0 0.14.15-r1
Chainguard milvus-2.5 0 2.5.27-r4
Chainguard nats 0 0.3.2-r0
Chainguard nats-fips 0 0.3.2-r0
Chainguard nats-top 0 0.6.3-r18
Chainguard nats-top-fips 0 0.6.3-r16
Chainguard prometheus-nats-exporter 0 0.19.1-r4
Chainguard prometheus-nats-exporter-fips 0 0.19.1-r4
Chainguard rke2-runtime-1.33 0 1.33.9.2.1-r3
Chainguard rke2-runtime-1.34 0 1.34.5.2.1-r3
Chainguard rke2-runtime-1.35 0 1.35.2.2.1-r3
Chainguard rke2-runtime-fips-1.34 0 1.34.6.2.1-r2
Chainguard rke2-runtime-fips-1.35 0 1.35.2.2.1-r2
Chainguard telegraf-1.37 0 1.37.3-r6
Chainguard telegraf-1.38 0 1.38.1-r1
Wolfi k3s 0 1.35.2.1-r4
Wolfi k3s-1.32 0 1.32.13.1-r7
Wolfi k3s-1.33 0 1.33.9.1-r6
Wolfi k3s-static 0 1.35.2.1-r4
Wolfi k3s-static-1.32 0 1.32.13.1-r7
Wolfi k3s-static-1.33 0 1.33.9.1-r6
Wolfi kine 0 0.14.15-r1
Wolfi nats 0 0.3.2-r0
Wolfi nats-top 0 0.6.3-r18
Wolfi prometheus-nats-exporter 0 0.19.1-r4
Wolfi telegraf-1.37 0 1.37.3-r6
Wolfi telegraf-1.38 0 1.38.1-r1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2

Related vulnerabilities