CVE-2026-33223: NATS-Server Auth Bypass Vulnerability

CVE-2026-33223 Overview

A security vulnerability has been identified in NATS-Server, a high-performance server for the NATS.io cloud and edge native messaging system. The vulnerability exists in the header stripping mechanism for the Nats-Request-Info: message header. This header is intended to serve as a server-guaranteed identity marker, but the implementation failed to fully strip this header from inbound messages. An attacker with valid credentials for any regular client interface could exploit this flaw to spoof their identity to downstream services that rely upon this header for authentication or authorization decisions.

Critical Impact
Authenticated attackers can spoof their identity to services relying on the Nats-Request-Info: header for identity verification, potentially bypassing authorization controls and accessing resources belonging to other users.

Affected Products

NATS-Server versions prior to 2.11.15
NATS-Server versions prior to 2.12.6
linuxfoundation nats-server

Discovery Timeline

2026-03-25 - CVE CVE-2026-33223 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33223

Vulnerability Analysis

This vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing). The core issue lies in the incomplete implementation of header sanitization within the NATS-Server message processing pipeline. The Nats-Request-Info: header is a special server-generated header that services use to verify the identity of message senders. Under normal operation, the NATS server should strip any client-supplied Nats-Request-Info: headers before processing messages, then inject its own authoritative header based on the authenticated client's identity.

However, due to the incomplete stripping mechanism, attackers can craft messages with specially formatted Nats-Request-Info: headers that bypass the sanitization logic. This allows an attacker who possesses valid credentials for any client connection to inject arbitrary identity information that downstream services will trust as server-verified.

Root Cause

The root cause is an insufficient input validation and header sanitization routine in the NATS-Server message ingestion path. The header stripping implementation did not account for all variations of the Nats-Request-Info: header format, allowing certain encodings or formatting to pass through unfiltered. This is a classic case of incomplete deny-list filtering where the sanitization logic failed to cover all possible attack vectors.

Attack Vector

The attack can be executed over the network by any authenticated client. The attacker must have valid credentials to establish a connection to the NATS server through any regular client interface. Once connected, the attacker can inject malicious Nats-Request-Info: headers in their messages to impersonate other users or services.

The attack flow involves:

Authenticating to the NATS server using valid client credentials
Crafting a message with a spoofed Nats-Request-Info: header containing the victim's identity
Sending the message through the NATS server
The header bypasses the incomplete stripping mechanism
Downstream services receive the message with the spoofed identity header and trust it as server-verified

No verified proof-of-concept code is publicly available for this vulnerability. For detailed technical information, refer to the GitHub NATS Security Advisory.

Detection Methods for CVE-2026-33223

Indicators of Compromise

Unusual patterns in Nats-Request-Info: headers, such as duplicate headers or non-standard formatting
Client messages containing Nats-Request-Info: headers that should only be server-generated
Authorization inconsistencies where actions are attributed to users who did not perform them
Log entries showing identity mismatches between authenticated session and header-claimed identity

Detection Strategies

Monitor NATS server logs for authentication and authorization anomalies
Implement application-level logging to track identity claims versus authenticated sessions
Deploy network monitoring to detect malformed or suspicious NATS protocol messages
Audit service-level access patterns for unexpected cross-user operations

Monitoring Recommendations

Enable verbose logging on NATS-Server to capture header information in message processing
Implement alerting for services that receive messages with unexpected identity claims
Review access logs for services that rely on Nats-Request-Info: for authorization decisions
Consider implementing secondary identity verification mechanisms until patching is complete

How to Mitigate CVE-2026-33223

Immediate Actions Required

Upgrade NATS-Server to version 2.11.15 or 2.12.6 immediately
Audit services that rely on Nats-Request-Info: headers for identity verification
Review access logs for any signs of identity spoofing attacks
Consider implementing additional application-level identity verification as defense-in-depth

Patch Information

The NATS maintainers have released patched versions that properly sanitize and strip the Nats-Request-Info: header from all inbound client messages. Users should upgrade to NATS-Server version 2.11.15 or 2.12.6 depending on their current release branch. For more details, see the NATS Security Advisory and the GitHub Security Advisory.

Workarounds

No official workarounds are available according to the vendor advisory
Upgrading to the patched versions is the only recommended mitigation
As a temporary measure, consider implementing additional authentication checks at the application layer
Restrict network access to the NATS server to trusted clients only until patching is complete

bash

# Upgrade NATS-Server to patched version
# For version 2.11.x branch:
nats-server --version  # Check current version
# Download and install nats-server 2.11.15 or later

# For version 2.12.x branch:
# Download and install nats-server 2.12.6 or later

# Verify the upgrade
nats-server --version
# Should show 2.11.15+ or 2.12.6+