CVE-2026-33216 - Vulnerability Analysis

Overview

NATS-Server < 2.11.15 and < 2.12.6 contains an information disclosure vulnerability caused by incorrect classification of MQTT passwords as non-authenticating JWTs, exposing them via monitoring endpoints, letting attackers access sensitive credentials, exploit requires access to monitoring endpoints.

Severity & Score

Impact

Attackers with access to monitoring endpoints can obtain MQTT passwords, leading to credential disclosure and potential unauthorized access.

Mitigation

Upgrade to versions 2.11.15 or 2.12.6 or later.

References

• https://advisories.nats.io/CVE/secnote-2026-05.txt
• https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099
• https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 25, 2026

🟠 CVE-2026-33216 - High (8.6) NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33216/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner