---
id: CVE-2026-33248
aliases:
  - GHSA-3f24-pcvm-5jqc
  - BIT-nats-2026-33248
  - GO-2026-4828
title: >-
  NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN
  matching
summary: >-
  NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN
  matching
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
vendor: nats-io
product: github.com/nats-io/nats-server/v2
ecosystem: go
affected:
  - github.com/nats-io/nats-server/v2 < 2.11.15
  - 'github.com/nats-io/nats-server/v2 >= 2.12.0-RC.1, < 2.12.6'
  - github.com/nats-io/nats-server
patched:
  - github.com/nats-io/nats-server/v2 2.11.15
  - github.com/nats-io/nats-server/v2 2.12.6
published: '2026-03-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:36.808606306Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3f24-pcvm-5jqc'
references:
  - url: >-
      https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqc
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33248'
  - url: 'https://advisories.nats.io/CVE/secnote-2026-13.txt'
  - url: 'https://github.com/nats-io/nats-server'
tags:
  - osv
  - go
epss: 0.00143
epssPercentile: 0.04003
ingestedAt: '2026-09-12T03:13:01.748Z'
---

## Overview

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.

### Problem Description

When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.

This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.

So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.

### Affected Versions

Fixed in nats-server 2.12.6 & 2.11.15

### Workarounds

Developers should review their CA issuing practices.

## Affected packages

- `github.com/nats-io/nats-server/v2 < 2.11.15`
- `github.com/nats-io/nats-server/v2 >= 2.12.0-RC.1, < 2.12.6`
- `github.com/nats-io/nats-server`

## Remediation

Upgrade to a patched release:

- `github.com/nats-io/nats-server/v2 2.11.15`
- `github.com/nats-io/nats-server/v2 2.12.6`