CVE-2026-33246: NATS Server Leafnode Connection Spoofing Vulnerability
Summary
CVE-2026-33246: NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers. Affects github.com/nats-io/nats-server/v2 across 2 version ranges.
< 2.11.15
>= 2.12.0-RC.1, < 2.12.6
Fixed in 2.11.15 or 2.12.6, depending on the release line you run. How to fix ↓
Also tracked for
- nats · Bitnami
- github.com/nats-io/nats-server · Go
The same CVE-2026-33246 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NATS.io is a high-performance open-source pub-sub distributed communication technology designed for cloud, on-premise, IoT, and edge computing. The nats-server facilitates hub/spoke topologies through 'leafnode' connections, allowing multiple nats-servers to communicate. NATS messages can include headers that provide essential information about requests.
Vulnerability Detail
The nats-server's 'Nats-Request-Info:' message header is intended to convey request information for account/user identification. However, leafnodes connecting to a nats-server are not fully trusted unless the system account is also bridged. This lack of trust allows for potential spoofing of the Nats-Request-Info header, leading to security risks for clients relying on this header for message validation. The vulnerability does not directly impact the nats-server itself but poses risks based on how clients might misuse the header.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.11.152.11.15go get github.com/nats-io/nats-server/v2@v2.11.15 -
>= 2.12.0-RC.1, < 2.12.62.12.6go get github.com/nats-io/nats-server/v2@v2.12.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds available for this vulnerability.
Conclusion
CVE-2026-33246 presents a significant risk for NATS server users, particularly those utilizing leafnode connections. It is crucial to update to the patched versions to mitigate the risk of spoofing and unauthorized access.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
CVE-2026-33246 is a vulnerability in the NATS server that allows spoofing of Nats-Request-Info identity headers through leafnode connections.
Any version of NATS before v2.12.6 or v2.11.15 is affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to monitor and check if your application is affected by this vulnerability without needing to sign up.
The potential risks include unauthorized access and message spoofing, as clients may trust messages based on the compromised Nats-Request-Info header.
Yes, the CVSS score for this vulnerability is 6.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
