CVE-2026-33248: NATS mTLS Authentication Bypass via Incorrect Subject DN Matching
Summary
CVE-2026-33248: NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching. Affects github.com/nats-io/nats-server/v2 across 2 version ranges.
< 2.11.15
>= 2.12.0-RC.1, < 2.12.6
Fixed in 2.11.15 or 2.12.6, depending on the release line you run. How to fix ↓
Also tracked for
- nats · Bitnami
- github.com/nats-io/nats-server · Go
The same CVE-2026-33248 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NATS.io is a high-performance open-source pub-sub distributed communication technology designed for cloud, on-premise, IoT, and edge computing. It supports various authentication models, including mTLS, which derives client identity from the properties of the TLS Client Certificate. This functionality is critical for secure communication in distributed systems.
Vulnerability Detail
The vulnerability arises when using mTLS for client identity with the 'verify_and_map' feature, which is intended to derive a NATS identity from the client certificate's Subject DN. Certain patterns of Relative Distinguished Name (RDN) are not correctly enforced, leading to potential authentication bypass. This issue requires a valid certificate from a trusted CA and specific DN naming patterns that are considered unlikely by NATS maintainers. However, sophisticated administrators may still be impacted, making this a moderate risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.11.152.11.15go get github.com/nats-io/nats-server/v2@v2.11.15 -
>= 2.12.0-RC.1, < 2.12.62.12.6go get github.com/nats-io/nats-server/v2@v2.12.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Review your CA issuing practices to ensure that the DN construction patterns do not inadvertently allow for authentication bypass. This may involve adjusting how certificates are issued and managed within your organization.
Conclusion
The NATS mTLS authentication bypass vulnerability (CVE-2026-33248) poses a moderate risk to systems using specific DN naming patterns. It is crucial for administrators to update to the patched versions and review their certificate issuance practices to ensure security.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
The vulnerability allows for authentication bypass in NATS when using mTLS due to incorrect matching of Subject DN patterns.
Administrators using mTLS with specific DN naming patterns that are not correctly enforced may be impacted.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.2, indicating a moderate severity level.
If immediate updates are not possible, review your CA issuing practices and adjust DN construction patterns to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
