CVE-2026-33248

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

• CWE-287
• CWE-295

• https://advisories.nats.io/CVE/secnote-2026-13.txtVendor Advisory
• https://github.com/nats-io/nats-server/security/advisories/GHSA-3f24-pcvm-5jqcVendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33242Salvo is a Rust web framework. Versions 0.39.0 through 0.89.…7.5
• CVE-2026-33243barebox is a bootloader. In barebox from version 2016.03.0 t…8.2
• CVE-2026-33244React Router is a router for React. In versions 7.5.1 throug…5.4
• CVE-2026-33245React Router is a router for React. In versions 7.7.0 throug…4.7
• CVE-2026-33246NATS-Server is a High-Performance server for NATS.io, a clou…5.4
• CVE-2026-33247NATS-Server is a High-Performance server for NATS.io, a clou…5.3
• CVE-2026-33249NATS-Server is a High-Performance server for NATS.io, a clou…4.3
• CVE-2026-3325SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the…10
• CVE-2026-33250Freeciv21 is a free open source, turn-based, empire-building…7.5
• CVE-2026-33251Discourse is an open-source discussion platform. Prior to ve…5.4
• CVE-2026-33252The Go MCP SDK used Go's standard encoding/json. Prior to ve…6.5
• CVE-2026-33253SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers …8.4