GitHub Advisoryadvisory · Go

GHSA-9983-vrx2-fg9c NATS JetStream has an authorization bypass through its Management API

MEDIUM Published 2026-03-24 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-33222
Ecosystem
Go
Packages
github.com/nats-io/nats-server/v2, github.com/nats-io/nats-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-285
Reviewed
2026-03-24

Affected packages

• Go github.com/nats-io/nats-server/v2: < 2.11.15 → fixed in 2.11.15 • Go github.com/nats-io/nats-server/v2: >= 2.12.0-RC.1, < 2.12.6 → fixed in 2.12.6 • Go github.com/nats-io/nats-server: all versions (no fix yet)

Description

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore. Problem Description Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Affected Versions Any version before v2.12.6 or v2.11.15 Workarounds If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.

Related

Alias · CVE (1)

  • CVE-2026-33222 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References