Most recent entries from all

BIT-nats-2026-33248 — NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Affected: Bitnami: nats

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

CLEANSTART-2026-YK24413 — Security fix for CVE-2026-33248 applied in: nats-server-fips 2.12.5-r1

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-277686

fkie_cve-2026-33248

GHSA-3f24-pcvm-5jqc — NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Affected: Go: github.com/nats-io/nats-server/v2, Go: github.com/nats-io/nats-server

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.

### Problem Description

When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.

This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.

So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.

### Affected Versions

Fixed in nats-server 2.12.6 & 2.11.15

### Workarounds

Developers should review their CA issuing practices.

UBUNTU-CVE-2026-33248

Affected: Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server

WID-SEC-W-2026-0858 — NATS Server: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.