EUVD-2026-15017
GHSA-fcjp-h8cc-6879
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.
AnalysisAI
NATS-Server versions prior to 2.11.15 and 2.12.5 contain an authentication bypass vulnerability in the MQTT client interface that allows attackers to hijack sessions and messages through malicious MQTT Client ID manipulation. The vulnerability affects all versions of nats-server using the affected version ranges and has a CVSS score of 6.5 (medium-high severity) due to the combination of high confidentiality impact and low availability impact. No known public exploits or active exploitation in the wild has been confirmed, but the authentication bypass nature (CWE-287) and patch availability indicate this is a practical, exploitable issue that requires immediate attention for organizations running affected versions.
Technical ContextAI
NATS-Server provides an MQTT client interface as part of its cloud and edge-native messaging system. The vulnerability stems from improper authentication and identity validation of MQTT clients, specifically related to how Client IDs are processed and validated during session establishment. The root cause falls under CWE-287 (Improper Authentication), indicating that the server fails to properly verify the identity of MQTT clients before granting session access or allowing message manipulation. An attacker can exploit this by crafting malicious MQTT Client ID values that either impersonate legitimate clients or bypass authentication checks entirely, leading to unauthorized session hijacking and message access. The issue is specific to the MQTT protocol implementation within NATS-Server, not the core NATS protocol itself.
RemediationAI
Immediately upgrade NATS-Server to version 2.11.15 or later if running the 2.11.x branch, or to version 2.12.5 or later if running the 2.12.x branch. Consult the official NATS-IO security advisory at https://advisories.nats.io/CVE/secnote-2026-06.tx and GitHub advisory at https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879 for detailed upgrade instructions and release notes. Since no workarounds are available, patching is the only mitigation path. For organizations with delayed patching capability, implement network segmentation to restrict MQTT client access to trusted internal networks only, disable the MQTT interface entirely if not required, and monitor MQTT connection logs for anomalous Client ID patterns or repeated connection attempts from unexpected sources.
More in Nats Server
View allNATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings ar
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are han
This affects all versions of package github.com/nats-io/nats-server/server. Rated high severity (CVSS 7.5), this vulnera
NATS nats-server before 2.7.2 has Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remote
Authentication bypass in NATS Server (nats-io/nats-server) lets an unauthenticated attacker on an adjacent network conne
Denial of service in NATS Server (nats-server) MQTT handler allows a remote, unauthenticated client to exhaust server me
Remote denial of service in the NATS Server (nats-io/nats-server) leafnode subsystem allows unauthenticated attackers to
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted reques
Remote denial-of-service in NATS Server (nats-server) affects deployments with the WebSocket listener enabled but MQTT d
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise,
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). Rated high s
Protocol injection in NATS Server MQTT support allows an authenticated MQTT client to smuggle control characters (tab, n
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today