Bug 2451486 (CVE-2026-33247) - CVE-2026-33247 github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments
Summary: CVE-2026-33247 github.com/nats-io/nats-server: NATS-Server: Information discl...
Keywords:
Status: NEW
Alias: CVE-2026-33247
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2451501
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-25 21:02 UTC by OSIDB Bzimport
Modified: 2026-03-25 21:26 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-25 21:02:31 UTC 
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials are visible to any user who can see the monitoring port, if that too is enabled. The `/debug/vars` end-point contains an unredacted copy of argv. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.
Note You need to log in before you can comment on or make changes to this bug.