CVE-2026-33248
Fixed in a distro release EPSS <1%CVSS 4.2
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.
Products: nats-io nats-server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/nats-io/nats-server | no fix |
| Go | github.com/nats-io/nats-server/v2 | 2.11.15 |
| Go | github.com/nats-io/nats-server/v2 | 2.12.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | k3s | 1.35.2.1-r4 |
| Chainguard | k3s-1.32 | 1.32.13.1-r7 |
| Chainguard | k3s-1.33 | 1.33.9.1-r6 |
| Chainguard | k3s-static | 1.35.2.1-r4 |
| Chainguard | k3s-static-1.32 | 1.32.13.1-r7 |
| Chainguard | k3s-static-1.33 | 1.33.9.1-r6 |
| Chainguard | kine | 0.14.15-r1 |
| Chainguard | milvus-2.5 | 2.5.27-r4 |
| Chainguard | nats | 0.3.2-r0 |
| Chainguard | nats-fips | 0.3.2-r0 |
| Chainguard | nats-top | 0.6.3-r18 |
| Chainguard | nats-top-fips | 0.6.3-r16 |
| Chainguard | prometheus-nats-exporter | 0.19.1-r4 |
| Chainguard | prometheus-nats-exporter-fips | 0.19.1-r4 |
| Chainguard | rke2-runtime-1.31 | no fix |
| Chainguard | rke2-runtime-1.32 | no fix |
| Chainguard | rke2-runtime-1.33 | 1.33.9.2.1-r3 |
| Chainguard | rke2-runtime-1.34 | 1.34.5.2.1-r3 |
| Chainguard | rke2-runtime-1.35 | 1.35.2.2.1-r3 |
| Chainguard | rke2-runtime-fips-1.31 | no fix |
| Chainguard | rke2-runtime-fips-1.32 | no fix |
| Chainguard | rke2-runtime-fips-1.33 | 1.33.10.2.3-r2 |
| Chainguard | rke2-runtime-fips-1.34 | 1.34.6.2.1-r2 |
| Chainguard | rke2-runtime-fips-1.35 | 1.35.2.2.1-r2 |
| Chainguard | telegraf-1.35 | no fix |
| Chainguard | telegraf-1.36 | no fix |
| Chainguard | telegraf-1.37 | 1.37.3-r6 |
| Chainguard | telegraf-1.38 | 1.38.1-r1 |
| Debian 12 | nats-server | no fix |
| Debian 13 | nats-server | no fix |
| Debian 14 | nats-server | 2.12.6-1 |
| Ubuntu 24.04 LTS | nats-server | no fix |
| Ubuntu 25.10 | nats-server | no fix |
| Ubuntu 26.10 | nats-server | no fix |
| Ubuntu Pro 26.04 LTS | nats-server | no fix |
| Wolfi | k3s | 1.35.2.1-r4 |
| Wolfi | k3s-1.32 | 1.32.13.1-r7 |
| Wolfi | k3s-1.33 | 1.33.9.1-r6 |
| Wolfi | k3s-static | 1.35.2.1-r4 |
| Wolfi | k3s-static-1.32 | 1.32.13.1-r7 |
| Wolfi | k3s-static-1.33 | 1.33.9.1-r6 |
| Wolfi | kine | 0.14.15-r1 |
| Wolfi | nats | 0.3.2-r0 |
| Wolfi | nats-top | 0.6.3-r18 |
| Wolfi | telegraf-1.36 | no fix |
| Wolfi | telegraf-1.37 | 1.37.3-r6 |
| Wolfi | telegraf-1.38 | 1.38.1-r1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260326T203309-150000.1.155.2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |