StackRadar

CVE-2026-33249

Medium

Advisory

Published 24 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
13
of 17,781 indexed, latest versions
Container images
14
deployed by those charts
Fix available
2 of 2
affected packages

NATS: Message tracing can be redirected to arbitrary subject

Carried by container images the latest versions of 13 of 17,781 indexed charts deploy, on 14 images.

Affected packageAffected versionsFixed inImages
github.com/nats-io/nats-server/v2golangv2.11.0, v2.11.1, v2.11.3, v2.11.4+4 more2.11.15, 2.12.613
natsbitnami2.11.8-02.11.151
OSV records
BIT-nats-2026-33249GHSA-8m2x-3m6q-6w8j
Also known as
GO-2026-4826

Charts affected

13 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.0.22 of 12See more

rocketchat rocketchat-server 7.0.2

2 of the 12 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.28031d190c7ee
github.com/nats-io/nats-server/v2@v2.12.0
2.12.6
natsio/prometheus-nats-exporter:0.18.002469dc907bc
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15

Open the chart page →

12,279
codefreshcodefresh-onpremOfficialVerified publisher2.12.131 of 42See more

codefresh codefresh-onprem 2.12.13

1 of the 42 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
bitnamilegacy/nats:2.11.8-debian-12-r0fa0cfba6034a
nats@2.11.8-0
2.11.15

Open the chart page →

14,956
topaztopaz0.2.51 of 1See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
github.com/nats-io/nats-server/v2@v2.11.1
2.11.15

Open the chart page →

1,494
octopuso7studios-octopus-helm-chartsOfficialVerified publisher1.2.31 of 5See more

octopus o7studios-octopus-helm-charts 1.2.3

1 of the 5 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
natsio/nats-box:0.18.0abdc9f9f0120
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15

Open the chart page →

6,091
glassflow-etlglassflowVerified publisher0.5.213 of 16See more

glassflow-etl glassflow 0.5.21

3 of the 16 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
library/nats:2.12.3-alpine88fe8e0e09d6
github.com/nats-io/nats-server/v2@v2.12.3
2.12.6
natsio/nats-box:0.19.28031d190c7ee
github.com/nats-io/nats-server/v2@v2.12.0
2.12.6
natsio/prometheus-nats-exporter:0.17.326c826662ac8
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15

Open the chart page →

12,056
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
github.com/nats-io/nats-server/v2@v2.12.4
2.12.6

Open the chart page →

7,659
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/nats-io/nats-server/v2@v2.11.0
2.11.15

Open the chart page →

45,239
testkube-apikubeshop2.1.1621 of 2See more

testkube-api kubeshop 2.1.162

1 of the 2 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
kubeshop/testkube-api-server:2.1.162e97dc620d9b4
github.com/nats-io/nats-server/v2@v2.11.4
2.11.15

Open the chart page →

1,663
vcluster-headloftVerified publisher0.0.0-035ec6e1 of 2See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/nats-io/nats-server/v2@v2.12.2
2.12.6

Open the chart page →

1,269
ocisocis-community0.1.01 of 1See more

ocis ocis-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
owncloud/ocis:8.0.1b38fd8fdd58f
github.com/nats-io/nats-server/v2@v2.12.3
2.12.6

Open the chart page →

2,346
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/nats-io/nats-server/v2@v2.12.0
2.12.6

Open the chart page →

2,525
service-exampleservice-example-jt0.1.13 of 9See more

service-example service-example-jt 0.1.1

3 of the 9 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
library/nats:2.12.2-alpine2d5fce3229ae
github.com/nats-io/nats-server/v2@v2.12.2
2.12.6
natsio/nats-box:0.19.28031d190c7ee
github.com/nats-io/nats-server/v2@v2.12.0
2.12.6
natsio/prometheus-nats-exporter:0.17.326c826662ac8
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15

Open the chart page →

7,157
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-33249.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/nats-io/nats-server/v2@v2.11.0
2.11.15

Open the chart page →

45,239

Container images carrying it

14 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
natsio/nats-box:0.19.28031d190c7ee
github.com/nats-io/nats-server/v2@v2.12.0
2.12.6
3
natsio/prometheus-nats-exporter:0.17.326c826662ac8
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15
2
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/nats-io/nats-server/v2@v2.11.0
2.11.15
2
bitnamilegacy/nats:2.11.8-debian-12-r0fa0cfba6034a
nats@2.11.8-0
2.11.15
1
kubeshop/testkube-api-server:2.1.162e97dc620d9b4
github.com/nats-io/nats-server/v2@v2.11.4
2.11.15
1
library/nats:2.12.2-alpine2d5fce3229ae
github.com/nats-io/nats-server/v2@v2.12.2
2.12.6
1
library/nats:2.12.3-alpine88fe8e0e09d6
github.com/nats-io/nats-server/v2@v2.12.3
2.12.6
1
natsio/nats-box:0.18.0abdc9f9f0120
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15
1
natsio/prometheus-nats-exporter:0.18.002469dc907bc
github.com/nats-io/nats-server/v2@v2.11.3
2.11.15
1
owncloud/ocis:8.0.1b38fd8fdd58f
github.com/nats-io/nats-server/v2@v2.12.3
2.12.6
1
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
github.com/nats-io/nats-server/v2@v2.11.1
2.11.15
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/nats-io/nats-server/v2@v2.12.2
2.12.6
1
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
github.com/nats-io/nats-server/v2@v2.12.4
2.12.6
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/nats-io/nats-server/v2@v2.12.0
2.12.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.