There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the
    `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and
    2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are
    incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring
    endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are
    adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other
    untrusted network users. (CVE-2026-33216)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-
    server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can
    by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known
    workarounds are available. (CVE-2026-33215)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the
    `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and
    2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server
    with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a
    workaround, disable leafnode support if not needed or restrict network connections to the leafnode port,
    if plausible without compromising the service offered. (CVE-2026-33218)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - NATS-Server 是適用於 NATS.io 的高效能伺服器，雲端和邊緣原生訊息系統。在 和 2.12.6版本2.11.15之前，在訊息主體上使用 ACL 時，這些 ACL 不會套用在「$MQTT.>」名稱空間中，因此允許 MQTT 用戶端略過 MQTT 主體的 ACL 檢查。版本 2.11.15 並 2.12.6 包含修正。尚無已知的因應措施可以採用。(CVE-2026-33217)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - NATS-Server 是用于 NATS.io 的高性能服务器，是一个云和边缘原生消息系统。在版本和之前的2.11.152.12.6版本中，当对消息主题使用 ACL 时，未在“$MQTT.>”命名空间应用这些 ACL，从而允许 MQTT 客户端绕过针对 MQTT 主题的 ACL 检查。版本并2.11.152.12.6包含一个补丁。没有已知的变通方案可用。(CVE-2026-33217)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - NATS-Serverは、クラウドおよびエッジネイティブメッセージングシステムである NATS.io 用の高性能サーバーです。バージョン 2.11.15 および 2.12.6より前では、メッセージサブジェクトでACLを使用する場合、これらのACLは「$MQTT.>」名前空間に適用されませんでした。これにより、MQTTクライアントはMQTTサブジェクトに対するACLチェックをバイパスできました。バージョン 2.11.15 および 2.12.6 には修正が含まれています。利用可能な既知の回避策はありません。(CVE-2026-33217)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to     versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the     `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and     2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
439165	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-jxxm-27vp-c3m5)	Tenable Self-Hosted Container Security	SCA Checks	2026/3/25	2026/7/2	medium
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/4/12	2026/7/2	high
439165	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-jxxm-27vp-c3m5)	Tenable Cloud Security	SCA Checks	2026/3/25	2026/7/2	medium
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/4/12	2026/7/2	high
303837	Linux Distros 未修補的弱點：CVE-2026-33217	Nessus	Misc.	2026/3/26	2026/7/18	medium
303837	Linux Distros 未修补的漏洞：CVE-2026-33217	Nessus	Misc.	2026/3/26	2026/7/18	medium
303837	Linux Distros のパッチ未適用の脆弱性: CVE-2026-33217	Nessus	Misc.	2026/3/26	2026/7/18	medium
303837	Linux Distros Unpatched Vulnerability : CVE-2026-33217	Nessus	Misc.	2026/3/26	2026/7/18	medium

检测

插件搜索

medium

high

medium

high

medium

medium

medium

medium