CVE-2026-33246

Medium

Advisory

Published 24 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.4; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 57; of 17,781 indexed, latest versions
Container images: 53; deployed by those charts
Fix available: 2 of 2; affected packages

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Carried by container images the latest versions of 57 of 17,781 indexed charts deploy, on 53 images.

Affected package	Affected versions	Fixed in	Images
github.com/nats-io/nats-server/v2golang	v0.0.0-20230518181934-4f2c9a51849d, v0.0.0-20230713200038-97dd7cb07a4f, v0.0.0-20231109212332-0883d32bbcc5, v0.0.0-20231206205519-fa8464d59b0a+36 more	2.11.15, 2.12.6	52
natsbitnami	2.11.8-0	2.11.15	1

OSV records: BIT-nats-2026-33246 GHSA-55h8-8g96-x4hj
Also known as: GO-2026-4830

Charts affected

57 by stars

Chart

Latest

Affected images

Radar Score

synadia-serversynadia

1.1.10

1 of 2 See more

synadia-server synadia 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.14.1	a67913df95f1	github.com/nats-io/nats-server/v2@v2.9.19	2.11.15

Open the chart page →

1,970

telegraf-ds-k3stelegraf-ds-k3s

1.0.0

1 of 1 See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
library/telegraf :1.19.0-alpine	794079a7f241	github.com/nats-io/nats-server/v2@v2.1.4	2.11.15

Open the chart page →

3,764

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
library/nats :2.10-alpine	b83efabe3e7d	github.com/nats-io/nats-server/v2@v0.0.0-20250501093519-f91ddd892565	2.11.15

Open the chart page →

7,248

posteetrivy-operator

2.14.0

2 of 3 See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
aquasec/postee :2.12.0-amd64	0795cba777e7	github.com/nats-io/nats-server/v2@v2.7.4	2.11.15
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	github.com/nats-io/nats-server/v2@v2.7.4	2.11.15

Open the chart page →

4,815

tfy-distributortruefoundry

0.0.1

2 of 4 See more

tfy-distributor truefoundry 0.0.1

2 of the 4 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
library/nats :2.10.7-alpine	1bcddab51b80	github.com/nats-io/nats-server/v2@v0.0.0-20231206205519-fa8464d59b0a	2.11.15
natsio/prometheus-nats-exporter :0.13.0	2adf791d9f9f	github.com/nats-io/nats-server/v2@v2.10.3	2.11.15

Open the chart page →

17,323

opencloudunxwares

0.2.3

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	github.com/nats-io/nats-server/v2@v2.11.0	2.11.15

Open the chart page →

45,239

nats-account-serverwenerme

0.8.1

1 of 1 See more

nats-account-server wenerme 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-33246.

Container image	Digest	Package	Fixed in
natsio/nats-account-server :1.0.0	a3381560aab6	github.com/nats-io/nats-server/v2@v2.3.3	2.11.15

Open the chart page →

2,634

Container images carrying it

53 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/matrix-org/dendrite-monolith :v0.9.4	3267d27d392f	github.com/nats-io/nats-server/v2@v2.8.5-0.20220811224153-d8d25d9b0b1c	2.11.15	1
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	github.com/nats-io/nats-server/v2@v2.12.4	2.12.6	1
quay.io/harikube/vcluster-pro :0.32.1	b741efae8d31	github.com/nats-io/nats-server/v2@v2.12.0	2.12.6	1