NATS: Message tracing can be redirected to arbitrary subject
cve-program · CVE-2026-33249
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Read the publisher's advisoryeuvd · EUVD-2026-16000
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Read the publisher's advisorynvd · CVE-2026-33249
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Read the publisher's advisoryosv · GHSA-8m2x-3m6q-6w8j
Published### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server supports telemetry on messages, using the per-message NATS headers. ### Problem Description A valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds None.
Read the publisher's advisoryosv · GO-2026-4826
PublishedNATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-33249 · CVE overview and exploitation status
cve-program · CVE-2026-33249
- https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j
- https://advisories.nats.io/CVE/secnote-2026-15.txt
euvd · EUVD-2026-16000
- https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j
- https://advisories.nats.io/CVE/secnote-2026-15.txt
nvd · CVE-2026-33249
- https://advisories.nats.io/CVE/secnote-2026-15.txt
- https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j
osv · GHSA-8m2x-3m6q-6w8j
- https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j
- https://nvd.nist.gov/vuln/detail/CVE-2026-33249
- https://advisories.nats.io/CVE/secnote-2026-15.txt
- https://github.com/nats-io/nats-server
osv · GO-2026-4826
Related changes
Linked by CVE identifierNo related changes are available here.