Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Published: 2026-03-25
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Message Identity Spoofing
Action: Patch
AI Analysis

Impact

NATS-Server includes a Nats-Request-Info header intended to expose request identity. A leafnode that is not fully trusted can inject this header, allowing an attacker to impersonate another client. This can mislead clients that rely on the header for access control decisions, potentially enabling unauthorized actions or data leakage.

Affected Systems

The issue affects the NATS Server from nats-io. Versions before 2.11.15 and before 2.12.6 are vulnerable; updating to 2.11.15 or newer, or 2.12.6 or newer, resolves the problem. The problem arises when a leafnode connects to a NATS server without proper identity validation.

Risk and Exploitability

The CVSS score of 6.4 indicates medium severity. The EPSS score is below 1%, suggesting a low likelihood of real-world exploitation. Attackers would need control over a leafnode connection to the server to inject forged Nats-Request-Info headers. If a client accepts the spoofed identity, it could be tricked into performing actions with the privileges of another user. No temporary workaround exists, so updating the server is the only mitigation.

Generated by OpenCVE AI on March 26, 2026 at 19:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the NATS Server to version 2.11.15 or later, or 2.12.6 or later as indicated in the release notes.

Generated by OpenCVE AI on March 26, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-55h8-8g96-x4hj NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
History

Sat, 28 Mar 2026 03:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Linuxfoundation
Linuxfoundation nats-server
CPEs cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*
Vendors & Products Linuxfoundation
Linuxfoundation nats-server

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Nats
Nats nats Server
Vendors & Products Nats
Nats nats Server

Thu, 26 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 25 Mar 2026 20:00:00 +0000

Type Values Removed Values Added
Description NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Title NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Weaknesses CWE-287
CWE-290
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Linuxfoundation Nats-server
Nats Nats Server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-28T01:42:55.527Z

Reserved: 2026-03-18T02:42:27.509Z

Link: CVE-2026-33246

cve-icon Vulnrichment

Updated: 2026-03-28T01:41:07.306Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T20:16:33.010

Modified: 2026-03-26T17:16:21.447

Link: CVE-2026-33246

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-25T19:50:03Z

Links: CVE-2026-33246 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-27T09:30:12Z

Weaknesses