What is the CVSS score of CVE-2026-33216?

CVE-2026-33216 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-33216?

Within 24 hours: Identify all NATS Server instances and assess which are running affected versions; document MQTT client usage and monitoring endpoint access controls. Within 7 days: Deploy patches to NATS Server v2.11.15 or v2.12.6 across all affected instances. Within 30 days: Audit monitoring access logs to detect exposure; rotate MQTT client credentials in use at any potentially compromised instances.

CVE-2026-33216

HIGH

Plaintext Storage of a Password (CWE-256)

2026-03-24 https://github.com/nats-io/nats-server

Information Disclosure

7.5

CVSS 3.1 · NVD

Temporal: 8.6

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

8.6 HIGH

cvss

vuln.today AI

7.5 HIGH

Plaintext MQTT passwords readable over the network via typically unauthenticated monitoring endpoints, so AV:N/AC:L/PR:N/UI:N with C:H and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Red Hat

8.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:47 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:47 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:46 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 04:46 vuln.today

Analysis Updated

Jun 30, 2026 - 04:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.6 (HIGH) 7.5 (HIGH)

Analysis Generated

Mar 24, 2026 - 21:46 vuln.today

Patch released

Mar 24, 2026 - 21:46 nvd

Patch available

CVE Published

Mar 24, 2026 - 21:42 nvd

HIGH 8.6

DescriptionNVD

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

Problem Description

For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

Ensure monitoring end-points are adequately secured.

Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

AnalysisAI

Credential disclosure in NATS Server (nats-server) before v2.11.15 and v2.12.6 exposes MQTT client passwords through the server's HTTP monitoring endpoints. When MQTT clients authenticate with username/password, the server mistakenly stores the password in the field reserved for a non-authenticating JWT identity statement, which is then surfaced verbatim in monitoring data such as connection listings. There is no public exploit identified at time of analysis and SSVC marks exploitation as none, the EPSS score is very low (0.03%), and a vendor patch is available.

Same weakness CWE-256 – Plaintext Storage of a Password

View all

CVE-2024-33375 CRITICAL POC

9.8

CVE-2018-25396 HIGH POC

8.7

CVE-2024-49370 HIGH POC

8.7

CVE-2024-40116 HIGH POC

8.1

CVE-2020-8183 HIGH POC

7.5

CVE-2019-10921 HIGH POC

7.5

CVE-2024-9418 MEDIUM POC

6.5

CVE-2020-37115 MEDIUM POC

6.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-33216 vulnerability details – vuln.today

Back

CVE-2026-33216

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

Background

Problem Description

Affected Versions

Workarounds

AnalysisAI

Same weakness CWE-256 – Plaintext Storage of a Password

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code