Cloudanix VulnDB

CVE-2026-33223

Medium · 6.4

CVSS

6.4

EPSS

0.2%

Published

Mar 25, 2026

CISA due date

—

The record

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard k3s 0 1.35.2.1-r4
Chainguard k3s-1.32 0 1.32.13.1-r7
Chainguard k3s-1.33 0 1.33.9.1-r6
Chainguard k3s-static 0 1.35.2.1-r4
Chainguard k3s-static-1.32 0 1.32.13.1-r7
Chainguard k3s-static-1.33 0 1.33.9.1-r6
Chainguard kine 0 0.14.15-r1
Chainguard milvus-2.5 0 2.5.27-r4
Chainguard nats 0 0.3.2-r0
Chainguard nats-fips 0 0.3.2-r0
Chainguard nats-top 0 0.6.3-r18
Chainguard nats-top-fips 0 0.6.3-r16
Chainguard prometheus-nats-exporter 0 0.19.1-r4
Chainguard prometheus-nats-exporter-fips 0 0.19.1-r4
Chainguard rke2-runtime-1.33 0 1.33.9.2.1-r3
Chainguard rke2-runtime-1.34 0 1.34.5.2.1-r3
Chainguard rke2-runtime-1.35 0 1.35.2.2.1-r3
Chainguard rke2-runtime-fips-1.34 0 1.34.6.2.1-r2
Chainguard rke2-runtime-fips-1.35 0 1.35.2.2.1-r2
Chainguard telegraf-1.37 0 1.37.3-r6
Chainguard telegraf-1.38 0 1.38.1-r1
Wolfi k3s 0 1.35.2.1-r4
Wolfi k3s-1.32 0 1.32.13.1-r7
Wolfi k3s-1.33 0 1.33.9.1-r6
Wolfi k3s-static 0 1.35.2.1-r4
Wolfi k3s-static-1.32 0 1.32.13.1-r7
Wolfi k3s-static-1.33 0 1.33.9.1-r6
Wolfi kine 0 0.14.15-r1
Wolfi nats 0 0.3.2-r0
Wolfi nats-top 0 0.6.3-r18
Wolfi prometheus-nats-exporter 0 0.19.1-r4
Wolfi telegraf-1.37 0 1.37.3-r6
Wolfi telegraf-1.38 0 1.38.1-r1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2

Related vulnerabilities