THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-33216 (HIGH 8.6) — NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exp

[NVD] CVE-2026-33216 (HIGH 8.6) — NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exp

lownvdPublished 2026-03-25

CVE-2026-33216 CVSS: 8.6 HIGH Published: 2026-03-25T20:16:32.320

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.

Indicators of compromise

CVE-2026-33216cve
nats.iodomain

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-33216