{"id":"AZL-81636","summary":"CVE-2026-33216 affecting package telegraf for versions less than 1.31.0-19","details":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.","modified":"2026-09-20T05:33:47Z","published":"2026-03-25T20:16:32Z","upstream":["CVE-2026-33216"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33216"}],"affected":[{"package":{"name":"telegraf","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/telegraf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-19"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-81636.json"}}],"schema_version":"1.9.0"}