https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:49:41.153704+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2026-33249 BIT-nats-2026-33249 — NATS: Message tracing can be redirected to arbitrary subject 2026-10-02T19:49:41.157405+00:00

Affected: Bitnami: nats

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-qf31649 CLEANSTART-2026-QF31649 — Security fix for CVE-2026-33249 applied in: nats-server-fips 2.12.5-r1 2026-10-02T19:49:41.157451+00:00

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-277685 EUVD-2026-277685 2026-10-02T19:49:41.157481+00:00 EUVD-2026-277685 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33249 fkie_cve-2026-33249 2026-10-02T19:49:41.157496+00:00

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-8m2x-3m6q-6w8j GHSA-8m2x-3m6q-6w8j — NATS: Message tracing can be redirected to arbitrary subject 2026-10-02T19:49:41.157519+00:00

Affected: Go: github.com/nats-io/nats-server/v2

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server supports telemetry on messages, using the per-message NATS headers.

### Problem Description

A valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission.

The payload is a valid trace message and not chosen by the attacker.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33249 UBUNTU-CVE-2026-33249 2026-10-02T19:49:41.157548+00:00

Affected: Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858 WID-SEC-W-2026-0858 — NATS Server: Mehrere Schwachstellen 2026-10-02T19:49:41.157571+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.