CVE-2026-33246Medium· 6.4▾ SunlitNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.1%
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers. NATS messages can have headers.
The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker.
A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked.
Thus NATS clients relying upon the Nats-Request-Info: header could be spoofed.
Does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header.
Any version before v2.12.6 or v2.11.15
None.
github.com/nats-io/nats-server/v2 < 2.11.15github.com/nats-io/nats-server/v2 >= 2.12.0-RC.1, < 2.12.6github.com/nats-io/nats-serverUpgrade to a patched release:
github.com/nats-io/nats-server/v2 2.11.15github.com/nats-io/nats-server/v2 2.12.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33248Medium· 4.2NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
CVE-2023-47090HighNATS.io: Adding accounts for just the system account adds auth bypass
CVE-2022-26652Medium· 6.5Arbitrary file write in nats-server
CVE-2020-26892Critical· 9.8Incorrect handling of credential expiry by /nats-io/nats-server
CVE-2021-3127Criticalnats-io/jwt not enforcing checking of Import token permissions
CVE-2020-28466High· 7.5Denial of service in github.com/nats-io/nats-server/server