NATS Server - CraftedSignal Threat Feed

NATS.io MQTT ACL Bypass Vulnerability

hello@craftedsignal.io — Wed, 24 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology used in cloud, on-premise, IoT, and edge computing environments. A critical vulnerability exists in the NATS server that allows MQTT clients to bypass Access Control List (ACL) checks when using the MQTT client interface. Specifically, ACLs are not enforced in the $MQTT.> namespace, which handles MQTT subjects. This flaw affects NATS server versions prior to v2.12.6 and v2.11.15, potentially enabling malicious MQTT clients to publish or subscribe to topics they should not have access to, leading to information disclosure or unauthorized control of the NATS messaging system. The vulnerability is identified as CVE-2026-33217 and presents a significant security risk for organizations relying on NATS for secure communication.

Attack Chain

An attacker identifies a NATS server running a vulnerable version (prior to v2.12.6 or v2.11.15) with MQTT enabled.
The attacker establishes an MQTT client connection to the NATS server.
The attacker crafts MQTT PUBLISH or SUBSCRIBE messages targeting subjects within the $MQTT.> namespace.
The NATS server, due to the vulnerability, fails to apply configured ACLs to the MQTT messages.
The attacker successfully publishes or subscribes to MQTT topics without proper authorization.
The attacker gains unauthorized access to MQTT data or control over MQTT devices connected to the NATS server.
The attacker can then leverage the unauthorized access for malicious purposes such as data exfiltration or disruption of services.

Impact

Successful exploitation of this vulnerability (CVE-2026-33217) can lead to unauthorized access to sensitive MQTT data within the NATS messaging system. This can affect any organization using NATS for MQTT communication, especially in IoT environments where MQTT is prevalent. The impact ranges from information disclosure to complete compromise of MQTT-controlled devices or services. The number of potential victims is dependent on the number of NATS deployments using MQTT functionality and running vulnerable versions, but given the widespread adoption of NATS, the potential impact is significant.

Recommendation

Upgrade NATS server instances to version v2.12.6 or v2.11.15 or later to remediate CVE-2026-33217.
Deploy the provided Sigma rule Detect Suspicious MQTT Namespace Access to identify potential exploitation attempts targeting the $MQTT.> namespace.
Monitor NATS server logs for suspicious activity related to MQTT connections and subject access using the $MQTT.> namespace.

NATS Server MQTT Password Disclosure Vulnerability

hello@craftedsignal.io — Tue, 23 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology. The NATS server provides an MQTT client interface. A vulnerability exists where MQTT passwords, when used with usercodes, are incorrectly classified as non-authenticating identity statements (JWT) and exposed via monitoring endpoints. This vulnerability affects NATS server versions before v2.12.6 and v2.11.15. Successful exploitation allows unauthorized access to MQTT credentials, potentially leading to broader access within the NATS environment. Defenders should prioritize patching and securing monitoring endpoints to mitigate this risk. The reported CVE is CVE-2026-33216.

Attack Chain

Attacker identifies a NATS server instance running a vulnerable version (prior to v2.12.6 or v2.11.15) with MQTT enabled.
MQTT is configured to use usercodes/passwords for authentication.
Attacker accesses the monitoring endpoint of the NATS server. This could be via a direct connection or through a proxy.
The NATS server incorrectly classifies the MQTT password as a non-authenticating JWT.
The server exposes the plaintext MQTT password in the monitoring endpoint's output.
The attacker retrieves the plaintext MQTT password from the monitoring endpoint.
Attacker uses the compromised MQTT credentials to authenticate to the NATS server via the MQTT client interface.
Attacker gains unauthorized access to NATS server resources and pub-sub channels accessible to the compromised MQTT user.

Impact

Successful exploitation of this vulnerability (CVE-2026-33216) allows an attacker to gain unauthorized access to MQTT credentials. This can lead to the attacker gaining access to sensitive data being transmitted through the NATS pub-sub system. The impact depends on the privileges associated with the compromised MQTT user and the data accessible through the NATS channels it can access. If the monitoring endpoint is exposed to the internet, the risk is significantly increased.

Recommendation

Upgrade NATS server instances to version v2.12.6 or v2.11.15 or later to remediate the vulnerability (CVE-2026-33216).
Implement strong access controls on the NATS server monitoring endpoints as suggested in the advisory to prevent unauthorized access.
Deploy the Sigma rule Detect NATS Server Monitoring Endpoint Access to identify suspicious access attempts to the monitoring endpoint.

NATS Server Credentials Exposure via Monitoring Port

hello@craftedsignal.io — Tue, 23 Jan 2024 12:00:00 +0000

NATS.io is a high-performance, open-source messaging system designed for cloud, on-premise, IoT, and edge computing environments. A vulnerability exists where credentials passed via command-line arguments (argv) to the nats-server are exposed through the server's monitoring port. Specifically, if a NATS server is launched with client authentication details specified directly in the command line, this information becomes visible via the /debug/vars endpoint. This affects NATS server versions prior to 2.11.15 and versions 2.12.0-RC.1 through 2.12.6. Attackers with access to the monitoring port can extract these credentials and potentially gain unauthorized access to the NATS messaging system. This exposure represents a significant security risk, especially in environments where the monitoring port is accessible from untrusted networks.

Attack Chain

A NATS server is deployed with the --user and --pass parameters in the command line (argv) to configure client authentication.
The monitoring port is enabled on the NATS server, typically on port 8222.
An attacker gains access to the monitoring port, either through network access or by exploiting a separate vulnerability.
The attacker sends an HTTP GET request to the /debug/vars endpoint on the monitoring port (e.g., http://nats-server:8222/debug/vars).
The server responds with a JSON payload containing system information, including the command-line arguments used to launch the server.
The attacker parses the JSON response and extracts the credentials specified in the --user and --pass parameters.
The attacker uses the extracted credentials to authenticate with the NATS server as a legitimate client.
The attacker gains unauthorized access to the NATS messaging system, enabling them to publish, subscribe, and manage messages within the system, potentially leading to data breaches or service disruption.

Impact

Successful exploitation allows unauthorized access to the NATS messaging system. The number of affected deployments is unknown, but any NATS server running a vulnerable version with command-line credentials and an exposed monitoring port is at risk. Compromised NATS deployments can lead to data breaches, service disruption, or the use of the messaging system for malicious purposes. Organizations in any sector utilizing NATS for inter-service communication or real-time data streaming are potentially affected.

Recommendation

Configure NATS server credentials within a dedicated configuration file instead of passing them via command-line arguments, as recommended in the advisory's "Workarounds" section.
Disable the monitoring port if command-line arguments are used for credential management, as mentioned in the advisory's "Workarounds" section.
Implement network access controls to restrict access to the monitoring port from untrusted networks, as stated in the advisory's "Workarounds" section.
Upgrade to NATS server version 2.11.15 or 2.12.6 or later to patch CVE-2026-33247 as described in the advisory.

NATS Server Panic via Malicious Compression on Leafnode Port

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology. A vulnerability exists when a NATS server is configured to accept leafnode connections, which is not the default setting. In this configuration, a malicious remote NATS server can trigger a server panic by exploiting the compression negotiation process on the leafnode port (default 7422). This vulnerability, identified as CVE-2026-29785, occurs pre-authentication, meaning an attacker does not need valid credentials. The vulnerability affects NATS server versions prior to v2.11.14 and versions between v2.12.0-RC.1 and v2.12.5. Defenders should disable compression on the leafnode port to mitigate this risk.

Attack Chain

The attacker identifies a NATS server with leafnode configuration enabled and compression active on port 7422.
The attacker establishes a connection to the leafnode port (7422) of the target NATS server.
The attacker initiates a compression negotiation handshake with the target server.
The attacker sends a crafted message during the compression negotiation, designed to exploit a vulnerability in the NATS server's compression handling logic.
The NATS server attempts to process the malicious compression data.
Due to the crafted nature of the data, the NATS server's compression library triggers a panic.
The NATS server process terminates abruptly due to the panic.
The NATS server becomes unavailable, disrupting NATS-based communication.

Impact

Successful exploitation of this vulnerability results in a denial-of-service (DoS) condition. Any NATS server configured to accept leafnode connections is vulnerable. This could impact cloud, on-premise, IoT, and edge computing environments using NATS for inter-service communication. The exact number of affected systems is unknown, but the impact is significant as it can disrupt critical communication pathways.

Recommendation

Disable compression on the leafnode port by setting compression: off in the NATS server configuration file as described in the advisory to remediate CVE-2026-29785.
Monitor network connections to port 7422, the default leafnode port, for unexpected connection attempts from untrusted sources (refer to the IOC table).
Deploy the Sigma rule to detect connections to the leafnode port with unexpected client IP addresses.

NATS Server Pre-Authentication Denial-of-Service via Leafnode Handling

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology widely used for cloud, on-premise, IoT, and edge computing environments. NATS servers utilize "leafnode" connections to enable hub/spoke topologies with other NATS servers. A critical vulnerability has been discovered affecting NATS servers prior to versions v2.12.6 and v2.11.15. This flaw allows an unauthenticated client capable of connecting to the leafnode port to trigger a server panic, resulting in a denial-of-service condition. This vulnerability, identified as CVE-2026-33218, highlights the importance of securing NATS deployments and promptly applying available patches or workarounds to prevent potential service disruptions.

Attack Chain

An attacker identifies a vulnerable NATS server with an exposed leafnode port.
The attacker establishes a network connection to the leafnode port (typically 7422).
The attacker sends a specially crafted, malformed message to the leafnode port. This message is designed to exploit a flaw in the pre-authentication handling of leafnode connections.
The NATS server attempts to process the malformed message without proper validation.
Due to the malformed nature of the message, a panic occurs within the NATS server's code, specifically related to leafnode message processing.
The panic causes the NATS server process to terminate abruptly.
The NATS server becomes unavailable, disrupting any applications or services relying on it.
This denial-of-service condition persists until the NATS server is manually restarted, and further attacks can repeat the process.

Impact

Successful exploitation of this vulnerability leads to a denial-of-service condition affecting the NATS server. The impact scope depends on the criticality of the NATS server within the affected environment. Services relying on the NATS server for communication will become unavailable, potentially disrupting business operations. The vulnerability affects all environments using vulnerable NATS server instances, including cloud deployments, on-premise installations, and edge computing scenarios. Widespread exploitation could result in significant operational disruptions across various sectors relying on NATS for real-time data streaming and messaging.

Recommendation

Immediately upgrade NATS servers to version v2.12.6 or v2.11.15 or later to patch CVE-2026-33218.
If upgrading is not immediately feasible, disable leafnode support on NATS servers if it is not required, mitigating the attack vector.
Restrict network connections to the leafnode port (default 7422) using firewalls or network access control lists, limiting potential attackers.
Monitor network connections to the leafnode port for unexpected or unauthorized access attempts, using network connection logs.