What is the CVSS score of CVE-2026-33216?

CVE-2026-33216 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Red Hat are affected by CVE-2026-33216?

NATS.io servers running affected versions are exposing MQTT user passwords through unprotected monitoring endpoints, creating a credential theft vulnerability accessible over the network.. A patch is available.

How to fix or mitigate CVE-2026-33216?

Within 24 hours: Identify all NATS.io deployments and determine which are running versions prior to v2.12.6 or v2.11.15, and whether MQTT functionality is enabled. Within 7 days: Upgrade affected nats-server instances to patched versions (v2.12.6, v2.11.15, or later). Within 30 days: Rotate all MQTT user credentials that may have been exposed, audit monitoring endpoint access logs for unauthorized retrieval attempts, and implement network-level access controls to restrict monitoring endpoint exposure.

Red Hat CVE-2026-33216

HIGH

Plaintext Storage of a Password (CWE-256)

2026-03-24 https://github.com/nats-io/nats-server

Information Disclosure Red Hat Suse

8.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 24, 2026 - 21:46 vuln.today

Patch released

Mar 24, 2026 - 21:46 nvd

Patch available

CVE Published

Mar 24, 2026 - 21:42 nvd

HIGH 8.6

DescriptionNVD

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

Problem Description

For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

Ensure monitoring end-points are adequately secured.

Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

AnalysisAI

NATS.io nats-server versions prior to v2.12.6 and v2.11.15 expose MQTT user passwords through unsecured monitoring endpoints. The vulnerability incorrectly classifies MQTT passwords as non-authenticating identity statements (JWT), causing them to leak via monitoring APIs accessible over the network without authentication. …

RemediationAI

Within 24 hours: Identify all NATS.io deployments and determine which are running versions prior to v2.12.6 or v2.11.15, and whether MQTT functionality is enabled. Within 7 days: Upgrade affected nats-server instances to patched versions (v2.12.6, v2.11.15, or later). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory