{"id":"BIT-nats-2026-33248","revision":null,"records":[{"revision":"29cf4ba21b0948bcaf19a728350983ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-33248","aliases":[],"title":"NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching","description":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.","state":0,"publishedAt":"2026-03-25T20:18:28.923+00:00","modifiedAt":"2026-03-26T19:52:12.357+00:00","affected":[{"ecosystem":"Vendor product","name":"nats-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nats-io\",\n                    \"product\": \"nats-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.11.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.12.0-RC.1, < 2.12.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.2,"severity":"MEDIUM"}],"references":["https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqc","https://advisories.nats.io/CVE/secnote-2026-13.txt"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-33248","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-33248","identifiers":["CVE-2026-33248"]},"retained":false,"historicalAffected":[]},{"revision":"1d137ca873c1403292d4a26063a0d672","observedAt":"2026-11-13T20:09:47.744+00:00","statement":{"source":"euvd","id":"EUVD-2026-15999","aliases":["CVE-2026-33248","GHSA-3f24-pcvm-5jqc"],"title":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certi…","description":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.2,"severity":null}],"references":["https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqc","https://advisories.nats.io/CVE/secnote-2026-13.txt"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-15999","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 25, 2026, 8:18:28 PM","dateUpdated":"Mar 26, 2026, 7:52:12 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-0858","title":"NATS Server: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-33215","CVE-2026-33216","CVE-2026-33217","CVE-2026-33218","CVE-2026-33219","CVE-2026-33222","CVE-2026-33223","CVE-2026-33246","CVE-2026-33247","CVE-2026-33248","CVE-2026-33249"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-15999","identifiers":["EUVD-2026-15999","CVE-2026-33248","GHSA-3f24-pcvm-5jqc"]},"retained":false,"historicalAffected":[]},{"revision":"4579ef27568c494984c9b1c8b326be3b","observedAt":"2026-10-25T08:17:18.375+00:00","statement":{"source":"nvd","id":"CVE-2026-33248","aliases":[],"title":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certi…","description":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.","state":0,"publishedAt":"2026-03-25T21:16:47.563+00:00","modifiedAt":"2026-06-17T10:37:11.377+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.2,"severity":"MEDIUM"}],"references":["https://advisories.nats.io/CVE/secnote-2026-13.txt","https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqc"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33248","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-287","CWE-295"],"productCriteria":["cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-03-25T21:16:47.563","lastModified":"2026-06-17T10:37:11.377"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-33248","identifiers":["CVE-2026-33248"]},"retained":false,"historicalAffected":[]},{"revision":"0362dca068c040d5904f6a9411ed69f8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-3f24-pcvm-5jqc","aliases":["BIT-nats-2026-33248","CVE-2026-33248","GO-2026-4828"],"title":"NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching","description":"### Background\n\nNATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.\n\nOne authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.\n\n### Problem Description\n\nWhen using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.\n\nThis does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.\n\nSo this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.\n\n### Affected Versions\n\nFixed in nats-server 2.12.6 & 2.11.15\n\n### Workarounds\n\nDevelopers should review their CA issuing practices.","state":0,"publishedAt":"2026-03-24T21:51:08+00:00","modifiedAt":"2026-09-10T03:50:36.8086063+00:00","affected":[{"ecosystem":"Go","name":"github.com/nats-io/nats-server/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.15"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/nats-io/nats-server/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.12.0-RC.1"},{"kind":"fixed","version":"2.12.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/nats-io/nats-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqc","https://nvd.nist.gov/vuln/detail/CVE-2026-33248","https://advisories.nats.io/CVE/secnote-2026-13.txt","https://github.com/nats-io/nats-server"],"sourceUrl":"https://github.com/advisories/GHSA-3f24-pcvm-5jqc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3f24-pcvm-5jqc","identifiers":["GHSA-3f24-pcvm-5jqc","BIT-nats-2026-33248","CVE-2026-33248","GO-2026-4828"]},"retained":false,"historicalAffected":[]},{"revision":"0c7bab2a6d4e4d10977b77431e0300bf","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4828","aliases":["BIT-nats-2026-33248","CVE-2026-33248","GHSA-3f24-pcvm-5jqc"],"title":"NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server","description":"NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server","state":0,"publishedAt":"2026-03-26T20:33:02+00:00","modifiedAt":"2026-03-27T18:26:05.115118+00:00","affected":[{"ecosystem":"Go","name":"github.com/nats-io/nats-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/nats-io/nats-server/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.15"},{"kind":"introduced","version":"2.12.0-RC.1"},{"kind":"fixed","version":"2.12.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqc","https://advisories.nats.io/CVE/secnote-2026-13.txt"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4828","license":"OSV · upstream source license applies","key":"osv:GO-2026-4828","identifiers":["GO-2026-4828","BIT-nats-2026-33248","CVE-2026-33248","GHSA-3f24-pcvm-5jqc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T15:44:35.9269651+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T15:44:35.9269651+00:00","lastSuccessAt":"2026-11-15T15:44:36.5463392+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:36.5463405+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-fe26fb3283d0188e4f1216c8a5f5e42b8b3a78e2b8ea03ea41743c12f8c225e3","complete":true,"records":425822,"lastAttemptAt":"2026-11-15T15:44:34.9158006+00:00","lastSuccessAt":"2026-11-15T15:44:34.777694+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:34.9158006+00:00","snapshotPublishedAt":"2026-11-15T15:23:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2591b0dc4e22463286f1b2e1fdad4426","complete":true,"records":13821,"lastAttemptAt":"2026-11-15T15:56:56.9999793+00:00","lastSuccessAt":"2026-11-15T15:56:56.987+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:56:56.987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T15:44:35.9269651+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T15:44:35.9269651+00:00","lastSuccessAt":"2026-11-15T15:44:36.5762509+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:36.5762516+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b8dcff928a3a4fd2a861cd283fe6f01b","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T15:44:56.5973506+00:00","lastSuccessAt":"2026-11-15T15:44:56.582+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:56.582+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T15:44:35.2999749+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:35.2999749+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T15:44:35.0073146+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:35.0073146+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T15:44:35.3356305+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:35.3356305+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T15:44:35.1483585+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T15:44:35.1483585+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}