Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2026-33247 is a high-severity Insertion of Sensitive Information Into Debugging Code (CWE-215) vulnerability in Linuxfoundation Nats-Server. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33247 is a vulnerability in NATS-Server, the high-performance server for the NATS.io cloud and edge native messaging system. In versions prior to 2.11.15 and 2.12.6, the issue occurs when static credentials for all clients are provided via command-line arguments (argv). If the monitoring port is enabled, these credentials appear unredacted in the /debug/vars endpoint, exposing sensitive information to anyone able to access that endpoint. The flaw is classified under CWE-215 (Cleartext Storage of Sensitive Information).
An attacker requires network access to the monitoring port, which must be explicitly enabled, making exploitation dependent on misconfiguration. No privileges or user interaction are needed, but the attack involves high complexity due to the need for port exposure. Successful exploitation reveals the static credentials, granting high confidentiality impact by leaking them and high integrity impact by potentially allowing impersonation of clients in the messaging system. The CVSS v3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Versions 2.11.15 and 2.12.6 of NATS-Server contain fixes for this vulnerability. As a workaround, configure credentials in a file instead of argv and disable the monitoring port if secrets are used in argv. Advisories emphasize not exposing the monitoring port to the Internet or untrusted networks as a best practice. Further details are in the NATS security note at https://advisories.nats.io/CVE/secnote-2026-14.txt and GitHub advisory GHSA-x6g4-f6q3-fqvv at https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15975
Vulnerability Data
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials are…
more
visible to any user who can see the monitoring port, if that too is enabled. The `/debug/vars` end-point contains an unredacted copy of argv. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5V13.4.2
Mitigating Controls (NIST 800-53 r5) AI
Least functionality directly prohibits enabling unnecessary debug features that would expose the inserted sensitive data.
Developer testing and evaluation will discover debug code containing sensitive information before release.
Prevents unintended transfer of sensitive command-line arguments or environment variables through shared OS resources visible to other processes.
Requiring documented secure development processes and standards stops insertion of sensitive data into debug paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit example of removing confidential data from process listings directly prevents visible sensitive arguments.
Secure SDLC practices directly prevent developers from embedding sensitive information inside debugging statements or code paths.
Hardened configuration baselines and deployment checks can ensure debug features and associated data are disabled in production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches debug statements and sensitive data leaks.
Separation of environments reduces accidental exposure of debug builds to production.
Restricting privileged utility programs reduces the chance that sensitive invocation data is exposed to other processes.
Privileged access rights reduce exposure of sensitive command-line arguments to unauthorized observers.
Secure SDLC mandates removal of debug code and sensitive data before release.
Secure coding standards explicitly prohibit embedding secrets or debug statements.