GHSA-jxxm-27vp-c3m5HighCVSS 7.1

NATS allows MQTT clients to bypass ACL checks

Published
March 24, 2026
Last Modified
March 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33217 →

📋 Description

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

Problem Description

When using ACLs on message subjects, these ACLs were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

None.

🎯 Affected products3

  • go/github.com/nats-io/nats-server/v2:< 2.11.15
  • go/github.com/nats-io/nats-server/v2:>= 2.12.0-RC.1, < 2.12.6
  • go/github.com/nats-io/nats-server:> 0

🔗 References (4)