NATS - CraftedSignal Threat Feed

NATS Server MQTT Password Disclosure Vulnerability

hello@craftedsignal.io — Tue, 23 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology. The NATS server provides an MQTT client interface. A vulnerability exists where MQTT passwords, when used with usercodes, are incorrectly classified as non-authenticating identity statements (JWT) and exposed via monitoring endpoints. This vulnerability affects NATS server versions before v2.12.6 and v2.11.15. Successful exploitation allows unauthorized access to MQTT credentials, potentially leading to broader access within the NATS environment. Defenders should prioritize patching and securing monitoring endpoints to mitigate this risk. The reported CVE is CVE-2026-33216.

Attack Chain

Attacker identifies a NATS server instance running a vulnerable version (prior to v2.12.6 or v2.11.15) with MQTT enabled.
MQTT is configured to use usercodes/passwords for authentication.
Attacker accesses the monitoring endpoint of the NATS server. This could be via a direct connection or through a proxy.
The NATS server incorrectly classifies the MQTT password as a non-authenticating JWT.
The server exposes the plaintext MQTT password in the monitoring endpoint's output.
The attacker retrieves the plaintext MQTT password from the monitoring endpoint.
Attacker uses the compromised MQTT credentials to authenticate to the NATS server via the MQTT client interface.
Attacker gains unauthorized access to NATS server resources and pub-sub channels accessible to the compromised MQTT user.

Impact

Successful exploitation of this vulnerability (CVE-2026-33216) allows an attacker to gain unauthorized access to MQTT credentials. This can lead to the attacker gaining access to sensitive data being transmitted through the NATS pub-sub system. The impact depends on the privileges associated with the compromised MQTT user and the data accessible through the NATS channels it can access. If the monitoring endpoint is exposed to the internet, the risk is significantly increased.

Recommendation

Upgrade NATS server instances to version v2.12.6 or v2.11.15 or later to remediate the vulnerability (CVE-2026-33216).
Implement strong access controls on the NATS server monitoring endpoints as suggested in the advisory to prevent unauthorized access.
Deploy the Sigma rule Detect NATS Server Monitoring Endpoint Access to identify suspicious access attempts to the monitoring endpoint.

NATS Server Panic via Malicious Compression on Leafnode Port

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology. A vulnerability exists when a NATS server is configured to accept leafnode connections, which is not the default setting. In this configuration, a malicious remote NATS server can trigger a server panic by exploiting the compression negotiation process on the leafnode port (default 7422). This vulnerability, identified as CVE-2026-29785, occurs pre-authentication, meaning an attacker does not need valid credentials. The vulnerability affects NATS server versions prior to v2.11.14 and versions between v2.12.0-RC.1 and v2.12.5. Defenders should disable compression on the leafnode port to mitigate this risk.

Attack Chain

The attacker identifies a NATS server with leafnode configuration enabled and compression active on port 7422.
The attacker establishes a connection to the leafnode port (7422) of the target NATS server.
The attacker initiates a compression negotiation handshake with the target server.
The attacker sends a crafted message during the compression negotiation, designed to exploit a vulnerability in the NATS server's compression handling logic.
The NATS server attempts to process the malicious compression data.
Due to the crafted nature of the data, the NATS server's compression library triggers a panic.
The NATS server process terminates abruptly due to the panic.
The NATS server becomes unavailable, disrupting NATS-based communication.

Impact

Successful exploitation of this vulnerability results in a denial-of-service (DoS) condition. Any NATS server configured to accept leafnode connections is vulnerable. This could impact cloud, on-premise, IoT, and edge computing environments using NATS for inter-service communication. The exact number of affected systems is unknown, but the impact is significant as it can disrupt critical communication pathways.

Recommendation

Disable compression on the leafnode port by setting compression: off in the NATS server configuration file as described in the advisory to remediate CVE-2026-29785.
Monitor network connections to port 7422, the default leafnode port, for unexpected connection attempts from untrusted sources (refer to the IOC table).
Deploy the Sigma rule to detect connections to the leafnode port with unexpected client IP addresses.

NATS Server Pre-Authentication Denial-of-Service via Leafnode Handling

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

NATS.io is a high-performance open-source pub-sub distributed communication technology widely used for cloud, on-premise, IoT, and edge computing environments. NATS servers utilize "leafnode" connections to enable hub/spoke topologies with other NATS servers. A critical vulnerability has been discovered affecting NATS servers prior to versions v2.12.6 and v2.11.15. This flaw allows an unauthenticated client capable of connecting to the leafnode port to trigger a server panic, resulting in a denial-of-service condition. This vulnerability, identified as CVE-2026-33218, highlights the importance of securing NATS deployments and promptly applying available patches or workarounds to prevent potential service disruptions.

Attack Chain

An attacker identifies a vulnerable NATS server with an exposed leafnode port.
The attacker establishes a network connection to the leafnode port (typically 7422).
The attacker sends a specially crafted, malformed message to the leafnode port. This message is designed to exploit a flaw in the pre-authentication handling of leafnode connections.
The NATS server attempts to process the malformed message without proper validation.
Due to the malformed nature of the message, a panic occurs within the NATS server's code, specifically related to leafnode message processing.
The panic causes the NATS server process to terminate abruptly.
The NATS server becomes unavailable, disrupting any applications or services relying on it.
This denial-of-service condition persists until the NATS server is manually restarted, and further attacks can repeat the process.

Impact

Successful exploitation of this vulnerability leads to a denial-of-service condition affecting the NATS server. The impact scope depends on the criticality of the NATS server within the affected environment. Services relying on the NATS server for communication will become unavailable, potentially disrupting business operations. The vulnerability affects all environments using vulnerable NATS server instances, including cloud deployments, on-premise installations, and edge computing scenarios. Widespread exploitation could result in significant operational disruptions across various sectors relying on NATS for real-time data streaming and messaging.

Recommendation

Immediately upgrade NATS servers to version v2.12.6 or v2.11.15 or later to patch CVE-2026-33218.
If upgrading is not immediately feasible, disable leafnode support on NATS servers if it is not required, mitigating the attack vector.
Restrict network connections to the leafnode port (default 7422) using firewalls or network access control lists, limiting potential attackers.
Monitor network connections to the leafnode port for unexpected or unauthorized access attempts, using network connection logs.