CVE-2026-33216 affects nats-io nats-server in MQTT deployments using usercodes and passwords. Prior to versions 2.11.15 and 2.12.6, MQTT passwords were incorrectly treated as non-authenticating JWT identity statements and thus exposed in plaintext via monitoring endpoints. This plaintext exposure constitutes a CWE-256 weakness (plaintext storage of sensitive information). The vulnerability has a CVSS 3.1 score of 8.6, indicating high severity with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. The issue is resolved in versions 2.11.15 and 2.12.6. No known exploits are reported in the wild. The product is not a cloud service, so remediation depends on user upgrades and configuration.

The vulnerability exposes MQTT passwords in plaintext through monitoring endpoints, potentially allowing unauthorized parties to obtain sensitive credentials if they can access these endpoints. This compromises confidentiality but does not affect integrity or availability. The high CVSS score reflects the ease of exploitation over the network without privileges or user interaction and the severe confidentiality impact. There are no known active exploits reported.

Upgrade nats-server to version 2.11.15 or 2.12.6 or later to apply the official fix. Until patched, ensure that monitoring endpoints are not exposed to untrusted networks and are adequately secured to prevent unauthorized access. Best practice is to avoid exposing monitoring endpoints to the Internet or other untrusted users. Patch status is confirmed by vendor advisory information embedded in the description.