GHSA-v722-jcv5-w7mc
NATS has MQTT plaintext password disclosure
Quick fix
GHSA-v722-jcv5-w7mc — github.com/nats-io/nats-server/v2: upgrade to the fixed version with the command below.
go get github.com/nats-io/nats-server/v2@v2.11.15Details
### Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
### Problem Description
For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.
### Affected Versions
Any version before v2.12.6 or v2.11.15
### Workarounds
Ensure monitoring end-points are adequately secured.
Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 2.11.15go get github.com/nats-io/nats-server/v2@v2.11.152.12.0-RC.1Fixed in: 2.12.6go get github.com/nats-io/nats-server/v2@v2.12.60No fixed version published yet for github.com/nats-io/nats-server (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-33216[ADVISORY]
- https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099[WEB]
- https://advisories.nats.io/CVE/secnote-2026-05.txt[WEB]
- https://github.com/nats-io/nats-server[PACKAGE]