https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:15:42.295699+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2026-33216 BIT-nats-2026-33216 — NATS has MQTT plaintext password disclosure 2026-10-03T07:15:42.401036+00:00

Affected: Bitnami: nats

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0406 certfr-2026-avi-0406 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu… 2026-10-03T07:15:42.401096+00:00 certfr-2026-avi-0406 https://cve.radiocsirt.org/vuln/cleanstart-2026-fz43945 CLEANSTART-2026-FZ43945 — Security fix for CVE-2026-33216 applied in: nats-server-fips 2.12.5-r1 2026-10-03T07:15:42.401117+00:00

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-365486 EUVD-2026-365486 2026-10-03T07:15:42.401139+00:00 EUVD-2026-365486 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33216 fkie_cve-2026-33216 2026-10-03T07:15:42.401152+00:00

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

 https://cve.radiocsirt.org/vuln/ghsa-v722-jcv5-w7mc GHSA-v722-jcv5-w7mc — NATS has MQTT plaintext password disclosure 2026-10-03T07:15:42.401175+00:00

Affected: Go: github.com/nats-io/nats-server/v2, Go: github.com/nats-io/nats-server

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

Ensure monitoring end-points are adequately secured.

Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33216 msrc_CVE-2026-33216 — NATS has MQTT plaintext password disclosure 2026-10-03T07:15:42.401220+00:00 msrc_CVE-2026-33216 https://cve.radiocsirt.org/vuln/rhsa-2026:21769 RHSA-2026:21769 — Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update 2026-10-03T07:15:42.401245+00:00

grafana/tempo: Tempo: Denial of Service via large queries net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via mal…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33216 UBUNTU-CVE-2026-33216 2026-10-03T07:15:42.401365+00:00

Affected: Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858 WID-SEC-W-2026-0858 — NATS Server: Mehrere Schwachstellen 2026-10-03T07:15:42.401392+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.