What is CVE-2026-33222?

CVE-2026-33222 is a medium-severity vulnerability in Linuxfoundation Nats-Server, classified under Improper Authorization. CVSS score: 4.9/10. Published 2026-03-25.

How severe is CVE-2026-33222?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Auth bypass in Linuxfoundation Nats-Server

CVE-2026-33222

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.

EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Linuxfoundation Nats-server
Nats-io Nats-server — versions < 2.11.15, >= 2.12.0-RC.1, < 2.12.6

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
security-advisories@github.com (x_refsource_MISC, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-33222?: CVE-2026-33222 is a medium-severity vulnerability in Linuxfoundation Nats-Server, classified under Improper Authorization. CVSS score: 4.9/10. Published 2026-03-25.
How severe is CVE-2026-33222?: Medium severity. CVSS v3 base score is 4.9 out of 10.