NATS JetStream has an authorization bypass through its Management API
cve-program · CVE-2026-33222
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Read the publisher's advisoryeuvd · EUVD-2026-15994
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Read the publisher's advisorynvd · CVE-2026-33222
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Read the publisher's advisoryosv · GHSA-9983-vrx2-fg9c
Published### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore. ### Problem Description Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Read the publisher's advisoryosv · GO-2026-4832
PublishedNATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-33222 · CVE overview and exploitation status
cve-program · CVE-2026-33222
- https://github.com/nats-io/nats-server/security/advisories/GHSA-9983-vrx2-fg9c
- https://advisories.nats.io/CVE/secnote-2026-12.txt
euvd · EUVD-2026-15994
- https://github.com/nats-io/nats-server/security/advisories/GHSA-9983-vrx2-fg9c
- https://advisories.nats.io/CVE/secnote-2026-12.txt
nvd · CVE-2026-33222
- https://advisories.nats.io/CVE/secnote-2026-12.txt
- https://github.com/nats-io/nats-server/security/advisories/GHSA-9983-vrx2-fg9c
osv · GHSA-9983-vrx2-fg9c
- https://github.com/nats-io/nats-server/security/advisories/GHSA-9983-vrx2-fg9c
- https://nvd.nist.gov/vuln/detail/CVE-2026-33222
- https://advisories.nats.io/CVE/secnote-2026-12.txt
- https://github.com/nats-io/nats-server
osv · GO-2026-4832
Related changes
Linked by CVE identifierNo related changes are available here.