{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/nats/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NATS server"],"_cs_severities":["high"],"_cs_tags":["nats","mqtt","credential-access","vulnerability"],"_cs_type":"advisory","_cs_vendors":["NATS"],"content_html":"\u003cp\u003eNATS.io is a high-performance open-source pub-sub distributed communication technology. The NATS server provides an MQTT client interface. A vulnerability exists where MQTT passwords, when used with usercodes, are incorrectly classified as non-authenticating identity statements (JWT) and exposed via monitoring endpoints. This vulnerability affects NATS server versions before v2.12.6 and v2.11.15. Successful exploitation allows unauthorized access to MQTT credentials, potentially leading to broader access within the NATS environment. Defenders should prioritize patching and securing monitoring endpoints to mitigate this risk. The reported CVE is CVE-2026-33216.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a NATS server instance running a vulnerable version (prior to v2.12.6 or v2.11.15) with MQTT enabled.\u003c/li\u003e\n\u003cli\u003eMQTT is configured to use usercodes/passwords for authentication.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the monitoring endpoint of the NATS server. This could be via a direct connection or through a proxy.\u003c/li\u003e\n\u003cli\u003eThe NATS server incorrectly classifies the MQTT password as a non-authenticating JWT.\u003c/li\u003e\n\u003cli\u003eThe server exposes the plaintext MQTT password in the monitoring endpoint's output.\u003c/li\u003e\n\u003cli\u003eThe attacker retrieves the plaintext MQTT password from the monitoring endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker uses the compromised MQTT credentials to authenticate to the NATS server via the MQTT client interface.\u003c/li\u003e\n\u003cli\u003eAttacker gains unauthorized access to NATS server resources and pub-sub channels accessible to the compromised MQTT user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability (CVE-2026-33216) allows an attacker to gain unauthorized access to MQTT credentials. This can lead to the attacker gaining access to sensitive data being transmitted through the NATS pub-sub system. The impact depends on the privileges associated with the compromised MQTT user and the data accessible through the NATS channels it can access. If the monitoring endpoint is exposed to the internet, the risk is significantly increased.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade NATS server instances to version v2.12.6 or v2.11.15 or later to remediate the vulnerability (CVE-2026-33216).\u003c/li\u003e\n\u003cli\u003eImplement strong access controls on the NATS server monitoring endpoints as suggested in the advisory to prevent unauthorized access.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect NATS Server Monitoring Endpoint Access\u003c/code\u003e to identify suspicious access attempts to the monitoring endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-23T12:00:00Z","date_published":"2024-01-23T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-23-nats-mqtt-disclosure/","summary":"The NATS server exposes MQTT passwords in plaintext via monitoring endpoints due to incorrect classification as JWTs, affecting versions before v2.12.6 or v2.11.15.","title":"NATS Server MQTT Password Disclosure Vulnerability","url":"https://feed.craftedsignal.io/briefs/2024-01-23-nats-mqtt-disclosure/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NATS server"],"_cs_severities":["high"],"_cs_tags":["nats","denial-of-service","compression"],"_cs_type":"advisory","_cs_vendors":["NATS"],"content_html":"\u003cp\u003eNATS.io is a high-performance open-source pub-sub distributed communication technology. A vulnerability exists when a NATS server is configured to accept leafnode connections, which is not the default setting. In this configuration, a malicious remote NATS server can trigger a server panic by exploiting the compression negotiation process on the leafnode port (default 7422). This vulnerability, identified as CVE-2026-29785, occurs pre-authentication, meaning an attacker does not need valid credentials. The vulnerability affects NATS server versions prior to v2.11.14 and versions between v2.12.0-RC.1 and v2.12.5. Defenders should disable compression on the leafnode port to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a NATS server with leafnode configuration enabled and compression active on port 7422.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a connection to the leafnode port (7422) of the target NATS server.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a compression negotiation handshake with the target server.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted message during the compression negotiation, designed to exploit a vulnerability in the NATS server's compression handling logic.\u003c/li\u003e\n\u003cli\u003eThe NATS server attempts to process the malicious compression data.\u003c/li\u003e\n\u003cli\u003eDue to the crafted nature of the data, the NATS server's compression library triggers a panic.\u003c/li\u003e\n\u003cli\u003eThe NATS server process terminates abruptly due to the panic.\u003c/li\u003e\n\u003cli\u003eThe NATS server becomes unavailable, disrupting NATS-based communication.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in a denial-of-service (DoS) condition. Any NATS server configured to accept leafnode connections is vulnerable. This could impact cloud, on-premise, IoT, and edge computing environments using NATS for inter-service communication. The exact number of affected systems is unknown, but the impact is significant as it can disrupt critical communication pathways.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDisable compression on the leafnode port by setting \u003ccode\u003ecompression: off\u003c/code\u003e in the NATS server configuration file as described in the advisory to remediate CVE-2026-29785.\u003c/li\u003e\n\u003cli\u003eMonitor network connections to port 7422, the default leafnode port, for unexpected connection attempts from untrusted sources (refer to the IOC table).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule to detect connections to the leafnode port with unexpected client IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-09T12:00:00Z","date_published":"2024-01-09T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-09-nats-server-panic/","summary":"A vulnerability exists in NATS servers configured to accept leafnode connections where a malicious remote NATS server can trigger a server panic by exploiting compression negotiation on the leafnode port.","title":"NATS Server Panic via Malicious Compression on Leafnode Port","url":"https://feed.craftedsignal.io/briefs/2024-01-09-nats-server-panic/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NATS Server"],"_cs_severities":["high"],"_cs_tags":["nats","denial-of-service","leafnode"],"_cs_type":"advisory","_cs_vendors":["NATS"],"content_html":"\u003cp\u003eNATS.io is a high-performance open-source pub-sub distributed communication technology widely used for cloud, on-premise, IoT, and edge computing environments. NATS servers utilize \u0026quot;leafnode\u0026quot; connections to enable hub/spoke topologies with other NATS servers. A critical vulnerability has been discovered affecting NATS servers prior to versions v2.12.6 and v2.11.15. This flaw allows an unauthenticated client capable of connecting to the leafnode port to trigger a server panic, resulting in a denial-of-service condition. This vulnerability, identified as CVE-2026-33218, highlights the importance of securing NATS deployments and promptly applying available patches or workarounds to prevent potential service disruptions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a vulnerable NATS server with an exposed leafnode port.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a network connection to the leafnode port (typically 7422).\u003c/li\u003e\n\u003cli\u003eThe attacker sends a specially crafted, malformed message to the leafnode port. This message is designed to exploit a flaw in the pre-authentication handling of leafnode connections.\u003c/li\u003e\n\u003cli\u003eThe NATS server attempts to process the malformed message without proper validation.\u003c/li\u003e\n\u003cli\u003eDue to the malformed nature of the message, a panic occurs within the NATS server's code, specifically related to leafnode message processing.\u003c/li\u003e\n\u003cli\u003eThe panic causes the NATS server process to terminate abruptly.\u003c/li\u003e\n\u003cli\u003eThe NATS server becomes unavailable, disrupting any applications or services relying on it.\u003c/li\u003e\n\u003cli\u003eThis denial-of-service condition persists until the NATS server is manually restarted, and further attacks can repeat the process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to a denial-of-service condition affecting the NATS server. The impact scope depends on the criticality of the NATS server within the affected environment. Services relying on the NATS server for communication will become unavailable, potentially disrupting business operations. The vulnerability affects all environments using vulnerable NATS server instances, including cloud deployments, on-premise installations, and edge computing scenarios. Widespread exploitation could result in significant operational disruptions across various sectors relying on NATS for real-time data streaming and messaging.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade NATS servers to version v2.12.6 or v2.11.15 or later to patch CVE-2026-33218.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, disable leafnode support on NATS servers if it is not required, mitigating the attack vector.\u003c/li\u003e\n\u003cli\u003eRestrict network connections to the leafnode port (default 7422) using firewalls or network access control lists, limiting potential attackers.\u003c/li\u003e\n\u003cli\u003eMonitor network connections to the leafnode port for unexpected or unauthorized access attempts, using network connection logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-nats-leafnode-panic/","summary":"A pre-authentication denial-of-service vulnerability exists in NATS servers before versions v2.12.6 and v2.11.15, allowing a remote client connected to the leafnode port to crash the server by sending a malformed message.","title":"NATS Server Pre-Authentication Denial-of-Service via Leafnode Handling","url":"https://feed.craftedsignal.io/briefs/2024-01-03-nats-leafnode-panic/"}],"language":"en","title":"CraftedSignal Threat Feed - NATS","version":"https://jsonfeed.org/version/1.1"}