CVE-2026-33247
MEDIUMSeverity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionNVD
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an optional monitoring port, which provides access to sensitive data. The nats-server can take certain configuration options on the command-line instead of requiring a configuration file.
Problem Description
If a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials are visible to any user who can see the monitoring port, if that too is enabled.
The /debug/vars end-point contains an unredacted copy of argv.
Patches
Fixed in nats-server 2.12.6 & 2.11.15
Workarounds
The NATS Maintainers are bemused at the concept of someone deploying a real configuration using --pass to avoid a config file, but also enabling monitoring.
Configure credentials inside a configuration file instead of via argv.
Do not enable the monitoring port if using secrets in argv.
Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.
AnalysisAI
A credential exposure vulnerability exists in NATS.io nats-server where static authentication credentials passed via command-line arguments are disclosed through the monitoring port's /debug/vars endpoint without redaction. NATS.io nats-server versions prior to 2.12.6 and 2.11.15 are affected. An attacker with network access to the monitoring port can retrieve plaintext credentials and gain unauthorized access to the messaging system, though this requires the uncommon configuration of both using command-line credentials and enabling monitoring.
Technical ContextAI
NATS.io is a high-performance publish-subscribe messaging system designed for cloud-native, edge, and IoT deployments. The affected product is identified via CPE as pkg:go/github.com_nats-io_nats-server_v2. This vulnerability is classified as CWE-215 (Insertion of Sensitive Information Into Debugging Code), occurring when the nats-server's optional monitoring port exposes the /debug/vars endpoint containing an unredacted copy of the process's argv array. When administrators configure static credentials using command-line flags like --pass instead of configuration files, these secrets become visible to anyone who can access the monitoring endpoint, effectively bypassing any expectation of credential confidentiality.
RemediationAI
Upgrade nats-server to version 2.12.6 or later for the 2.12.x branch, or version 2.11.15 or later for the 2.11.x branch as documented in the GitHub security advisory at https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv. As immediate workarounds, migrate credential configuration from command-line arguments to configuration files where secrets are properly handled, or disable the monitoring port entirely if command-line credentials must be used. Following NATS best practices, restrict monitoring port access to trusted networks only and never expose it to the Internet, implementing network segmentation and firewall rules to limit access to authorized administrators. Additional security guidance is available at https://advisories.nats.io/CVE/secnote-2026-14.txt.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today