https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:21:44.459184+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2026-33215 BIT-nats-2026-33215 — NATS is vulnerable to MQTT hijacking via Client ID 2026-10-03T19:21:44.474996+00:00

Affected: Bitnami: nats

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-wk59830 CLEANSTART-2026-WK59830 — Security fix for CVE-2026-33215 applied in: nats-server-fips 2.12.5-r1 2026-10-03T19:21:44.475053+00:00

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-277331 EUVD-2026-277331 2026-10-03T19:21:44.475076+00:00 EUVD-2026-277331 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33215 fkie_cve-2026-33215 2026-10-03T19:21:44.475091+00:00

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-fcjp-h8cc-6879 GHSA-fcjp-h8cc-6879 — NATS is vulnerable to MQTT hijacking via Client ID 2026-10-03T19:21:44.475114+00:00

Affected: Go: github.com/nats-io/nats-server/v2

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

Sessions and Messages can by hijacked via MQTT Client ID malfeasance.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.

### Resources

* This document is canonically: <https://advisories.nats.io/CVE/secnote-2026-06.txt> * GHSA advisory: <https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879> * MITRE CVE entry: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33215>

 https://cve.radiocsirt.org/vuln/rhsa-2026:21769 RHSA-2026:21769 — Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update 2026-10-03T19:21:44.475146+00:00

grafana/tempo: Tempo: Denial of Service via large queries net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via mal…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33215 UBUNTU-CVE-2026-33215 2026-10-03T19:21:44.475233+00:00

Affected: Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858 WID-SEC-W-2026-0858 — NATS Server: Mehrere Schwachstellen 2026-10-03T19:21:44.475258+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.