When a client uses message tracing headers, the server treats the trace messages as normal messages and publishes them to the subject specified in the header, even if the client lacks permission to publish there. The attacker cannot choose the payload, but can force the server to expose trace data on otherwise protected subjects, potentially leaking sensitive information or violating access controls.

NATS‑Io Server is affected. Versions 2.11.0 through 2.11.14 and 2.12.0 through 2.12.5 allow the issue; releases 2.11.15 and 2.12.6 and later include a fix.

The CVSS score of 4.3 indicates moderate severity while the EPSS score below 1 % suggests low exploit probability. The vulnerability is not listed in the KEV catalog. An attacker must have a legitimate NATS client connection with tracing enabled; after that, the server can be coerced into publishing trace messages to arbitrary subjects. No privileged escalation beyond the client’s own permissions is required.