nats-io nats-server up to 2.11.14/2.12.5 mTLS verify_and_map certificate validation

Summaryinfo

A vulnerability described as critical has been identified in nats-io nats-server up to 2.11.14/2.12.5. This issue affects the function verify_and_map of the component mTLS. Such manipulation leads to certificate validation. This vulnerability is traded as CVE-2026-33248. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in nats-io nats-server up to 2.11.14/2.12.5 and classified as problematic. Affected by this issue is the function verify_and_map of the component mTLS. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. CVE summarizes:

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-33248. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 303841 (Linux Distros Unpatched Vulnerability : CVE-2026-33248), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.11.15 or 2.12.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (303841). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• nats-io

Name

• nats-server

Version

• 2.11.0
• 2.11.1
• 2.11.2
• 2.11.3
• 2.11.4
• 2.11.5
• 2.11.6
• 2.11.7
• 2.11.8
• 2.11.9
• 2.11.10
• 2.11.11
• 2.11.12
• 2.11.13
• 2.11.14
• 2.12.0
• 2.12.1
• 2.12.2
• 2.12.3
• 2.12.4
• 2.12.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion