Cloudanix VulnDB

CVE-2026-33222

Medium · 4.9

CVSS

4.9

EPSS

0.4%

Published

Mar 25, 2026

CISA due date

—

The record

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard k3s 0 1.35.2.1-r4
Chainguard k3s-1.32 0 1.32.13.1-r7
Chainguard k3s-1.33 0 1.33.9.1-r6
Chainguard k3s-static 0 1.35.2.1-r4
Chainguard k3s-static-1.32 0 1.32.13.1-r7
Chainguard k3s-static-1.33 0 1.33.9.1-r6
Chainguard kine 0 0.14.15-r1
Chainguard milvus-2.5 0 2.5.27-r4
Chainguard nats 0 0.3.2-r0
Chainguard nats-fips 0 0.3.2-r0
Chainguard nats-top 0 0.6.3-r18
Chainguard nats-top-fips 0 0.6.3-r16
Chainguard prometheus-nats-exporter 0 0.19.1-r4
Chainguard prometheus-nats-exporter-fips 0 0.19.1-r4
Chainguard rke2-runtime-1.33 0 1.33.9.2.1-r3
Chainguard rke2-runtime-1.34 0 1.34.5.2.1-r3
Chainguard rke2-runtime-1.35 0 1.35.2.2.1-r3
Chainguard rke2-runtime-fips-1.34 0 1.34.6.2.1-r2
Chainguard rke2-runtime-fips-1.35 0 1.35.2.2.1-r2
Chainguard telegraf-1.37 0 1.37.3-r6
Chainguard telegraf-1.38 0 1.38.1-r1
Wolfi k3s 0 1.35.2.1-r4
Wolfi k3s-1.32 0 1.32.13.1-r7
Wolfi k3s-1.33 0 1.33.9.1-r6
Wolfi k3s-static 0 1.35.2.1-r4
Wolfi k3s-static-1.32 0 1.32.13.1-r7
Wolfi k3s-static-1.33 0 1.33.9.1-r6
Wolfi kine 0 0.14.15-r1
Wolfi nats 0 0.3.2-r0
Wolfi nats-top 0 0.6.3-r18
Wolfi prometheus-nats-exporter 0 0.19.1-r4
Wolfi telegraf-1.37 0 1.37.3-r6
Wolfi telegraf-1.38 0 1.38.1-r1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2

Related vulnerabilities