https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:06:34.314007+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2026-33248 BIT-nats-2026-33248 — NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching 2026-10-03T08:06:34.411846+00:00

Affected: Bitnami: nats

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-yk24413 CLEANSTART-2026-YK24413 — Security fix for CVE-2026-33248 applied in: nats-server-fips 2.12.5-r1 2026-10-03T08:06:34.411995+00:00

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-277686 EUVD-2026-277686 2026-10-03T08:06:34.412022+00:00 EUVD-2026-277686 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33248 fkie_cve-2026-33248 2026-10-03T08:06:34.412037+00:00

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

 https://cve.radiocsirt.org/vuln/ghsa-3f24-pcvm-5jqc GHSA-3f24-pcvm-5jqc — NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching 2026-10-03T08:06:34.412074+00:00

Affected: Go: github.com/nats-io/nats-server/v2, Go: github.com/nats-io/nats-server

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.

### Problem Description

When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.

This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.

So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.

### Affected Versions

Fixed in nats-server 2.12.6 & 2.11.15

### Workarounds

Developers should review their CA issuing practices.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33248 UBUNTU-CVE-2026-33248 2026-10-03T08:06:34.412112+00:00

Affected: Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858 WID-SEC-W-2026-0858 — NATS Server: Mehrere Schwachstellen 2026-10-03T08:06:34.412142+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.