CVE-2026-33215

Опубликовано: 24 мар. 2026

Источник: redhat

CVSS3: 6.5

EPSS Низкий

Описание

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

A flaw was found in NATS-Server. A remote attacker could exploit this vulnerability by manipulating MQTT (Message Queuing Telemetry Transport) Client IDs. This malfeasance allows for the hijacking of client sessions and messages. This could lead to unauthorized access to sensitive information or disruption of service.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat OpenShift Container Platform 4	openshift4/oc-mirror-plugin-rhel9	Not affected
Multicluster Global Hub 1.4.5	multicluster-globalhub/multicluster-globalhub-grafana-rhel9	Fixed	RHSA-2026:22347	01.06.2026
Multicluster Global Hub 1.5.4	multicluster-globalhub/multicluster-globalhub-grafana-rhel9	Fixed	RHSA-2026:21769	28.05.2026
Multicluster Global Hub 1.6.2	multicluster-globalhub/multicluster-globalhub-grafana-rhel9	Fixed	RHSA-2026:23345	04.06.2026

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-290

https://bugzilla.redhat.com/show_bug.cgi?id=2451021nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance

EPSS

Процентиль: 15%

0.0024

Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVE-2026-33215

CVSS3: 6.5

ubuntu

5 месяцев назад

CVE-2026-33215

CVSS3: 6.5

nvd

5 месяцев назад

CVE-2026-33215

CVSS3: 6.5

debian

5 месяцев назад

NATS-Server is a High-Performance server for NATS.io, a cloud and edge ...

GHSA-fcjp-h8cc-6879

CVSS3: 6.5

github

5 месяцев назад

NATS is vulnerable to MQTT hijacking via Client ID

EPSS

Процентиль: 15%

0.0024

Низкий

6.5 Medium

CVSS3