CVE-2026-33247: 
NixOS vulnerability analysis and mitigation

CVE-2026-33247 is an information disclosure vulnerability in NATS-Server (nats-io/nats-server) where static client credentials passed via command-line arguments (argv) are exposed in plaintext through the monitoring port's /debug/vars endpoint. It affects all nats-server versions prior to 2.11.15 and versions 2.12.0-RC.1 through 2.12.5. The vulnerability was published on March 24, 2026, and patched versions were released the same day (GitHub Advisory). The CVSS v3.1 base score is 7.4 (High) per the GitHub Security Advisory, though the Feedly/NVD entry records a score of 5.3 (Medium) with slightly different metrics (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-215 (Insertion of Sensitive Information Into Debugging Code) and CWE-214 (Invocation of Process Using Visible Sensitive Information). When nats-server is started with credentials (e.g., passwords via --pass) supplied directly on the command line, the Go runtime exposes the full os.Args (argv) array through the /debug/vars HTTP endpoint on the monitoring port without any redaction (GitHub Advisory, NATS Advisory). Exploitation requires that both conditions are simultaneously true: credentials are passed via argv AND the monitoring port is enabled and accessible to the attacker. The attack vector is network-based with high complexity, as it depends on this specific misconfiguration being present (GitHub Advisory).

Successful exploitation allows an attacker with access to the monitoring port to retrieve plaintext NATS client credentials (e.g., passwords, tokens) from the /debug/vars endpoint. These credentials could then be used to authenticate to the NATS messaging system, potentially enabling unauthorized message publishing/subscribing, lateral movement within the messaging infrastructure, or access to sensitive data transiting the NATS bus. The confidentiality impact is rated High, with no direct integrity or availability impact from the disclosure itself (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that both the monitoring port is enabled and credentials are passed via argv — a configuration the NATS maintainers describe as unusual for production deployments (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible nats-server instances running versions prior to 2.11.15 or between 2.12.0 and 2.12.5, using network scanning tools (e.g., Shodan, Censys, nmap) targeting the default NATS monitoring port (8222).
2. Verify monitoring port: Confirm the monitoring port is enabled and accessible by sending an HTTP GET request to http://<target>:8222/ and checking for a valid NATS monitoring response.
3. Access the debug endpoint: Send an HTTP GET request to http://<target>:8222/debug/vars to retrieve the exported Go runtime variables, which include the unredacted cmdline (argv) array.
4. Extract credentials: Parse the JSON response from /debug/vars to locate the cmdline field, which will contain the full command-line arguments including any credentials passed via flags such as --pass, --auth, or similar options.
5. Authenticate to NATS: Use the extracted credentials to connect to the NATS server (default port 4222) and perform unauthorized operations such as subscribing to subjects, publishing messages, or accessing restricted data (GitHub Advisory, NATS Advisory).

• Network: Unexpected or unauthorized HTTP GET requests to http://<nats-server>:<monitoring-port>/debug/vars; access to the monitoring port from untrusted or external IP addresses.
• Logs: Web server/access logs on the monitoring port showing requests to /debug/vars from unfamiliar source IPs; repeated polling of the monitoring endpoint.
• Process: nats-server process started with credential-bearing flags (e.g., --pass, --auth) visible in process listings (ps aux, /proc/<pid>/cmdline) alongside an enabled monitoring port (-m or --http_port flags present).
• Authentication: Unexpected or anomalous NATS client connections using static credentials, particularly from new or unrecognized client IPs shortly after monitoring port access.

Upgrade nats-server to version 2.11.15 or 2.12.6, which redact sensitive argv values from the /debug/vars endpoint (GitHub Advisory, NATS Advisory). If immediate upgrade is not possible, apply both workarounds: (1) move all credentials from command-line arguments into a configuration file, and (2) disable the monitoring port or restrict access to it via firewall rules to trusted hosts only. As a general best practice, the monitoring port should never be exposed to the Internet or untrusted network segments (GitHub Advisory).

The NATS maintainers noted in the advisory that they are "bemused at the concept of someone deploying a real configuration using --pass to avoid a config file, but also enabling monitoring," indicating the vulnerability requires an unusual combination of misconfigurations (GitHub Advisory). Red Hat tracked the issue via Bugzilla and classified it as high severity (Red Hat Bugzilla). openSUSE also issued a security announcement for the affected package (openSUSE Security).