Skip to content

Commit 7d04432

Browse files
azurelinux-securityakhila-gurujuv-aaditya
authored andcommitted
[AutoPR- Security] Patch telegraf for CVE-2026-33216, CVE-2026-29785 [HIGH] (#16431)
Co-authored-by: akhila-guruju <v-guakhila@microsoft.com> Co-authored-by: Aditya Singh <v-aditysing@microsoft.com> (cherry picked from commit 4e6d4cf)
1 parent 395c8c7 commit 7d04432

File tree

3 files changed

+140
-1
lines changed

3 files changed

+140
-1
lines changed
Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
From 2c1b4d1bf00adcbaf61caf126c74169f8b246d3b Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Thu, 2 Apr 2026 15:13:42 +0000
4+
Subject: [PATCH] Fix panic on LS protocol when compression enabled: guard
5+
against LS+ and LS- before CONNECT; close with auth violation
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
8+
Upstream-reference: AI Backport of https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8.patch
9+
---
10+
.../nats-io/nats-server/v2/server/leafnode.go | 19 ++++++++++++++++++-
11+
1 file changed, 18 insertions(+), 1 deletion(-)
12+
13+
diff --git a/vendor/github.com/nats-io/nats-server/v2/server/leafnode.go b/vendor/github.com/nats-io/nats-server/v2/server/leafnode.go
14+
index 8f3fe627..652ec5d1 100644
15+
--- a/vendor/github.com/nats-io/nats-server/v2/server/leafnode.go
16+
+++ b/vendor/github.com/nats-io/nats-server/v2/server/leafnode.go
17+
@@ -2325,6 +2325,15 @@ func (c *client) processLeafSub(argo []byte) (err error) {
18+
}
19+
20+
acc := c.acc
21+
+ // Guard against LS+ arriving before CONNECT has been processed, which
22+
+ // can happen when compression is enabled.
23+
+ if acc == nil {
24+
+ c.mu.Unlock()
25+
+ c.sendErr("Authorization Violation")
26+
+ c.closeConnection(ProtocolViolation)
27+
+ return nil
28+
+ }
29+
+
30+
// Check if we have a loop.
31+
ldsPrefix := bytes.HasPrefix(sub.subject, []byte(leafNodeLoopDetectionSubjectPrefix))
32+
33+
@@ -2444,7 +2453,6 @@ func (c *client) processLeafUnsub(arg []byte) error {
34+
// Indicate any activity, so pub and sub or unsubs.
35+
c.in.subs++
36+
37+
- acc := c.acc
38+
srv := c.srv
39+
40+
c.mu.Lock()
41+
@@ -2453,6 +2461,15 @@ func (c *client) processLeafUnsub(arg []byte) error {
42+
return nil
43+
}
44+
45+
+ acc := c.acc
46+
+ // Guard against LS- arriving before CONNECT has been processed.
47+
+ if acc == nil {
48+
+ c.mu.Unlock()
49+
+ c.sendErr("Authorization Violation")
50+
+ c.closeConnection(ProtocolViolation)
51+
+ return nil
52+
+ }
53+
+
54+
updateGWs := false
55+
spoke := c.isSpokeLeafNode()
56+
// We store local subs by account and subject and optionally queue name.
57+
--
58+
2.45.4
59+
Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
From 5ad836f2e5705b1dbf87437f681c8f9a85b07adf Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Thu, 2 Apr 2026 15:18:09 +0000
4+
Subject: [PATCH] Backport: Fix MQTT password exposed in JWT by deferring
5+
setting JWT for MQTT and using local ujwt in auth; remove setting JWT in
6+
mqttParseConnect
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: AI Backport of https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099.patch
10+
---
11+
.../nats-io/nats-server/v2/server/auth.go | 16 ++++++++++++++--
12+
.../nats-io/nats-server/v2/server/mqtt.go | 1 -
13+
2 files changed, 14 insertions(+), 3 deletions(-)
14+
15+
diff --git a/vendor/github.com/nats-io/nats-server/v2/server/auth.go b/vendor/github.com/nats-io/nats-server/v2/server/auth.go
16+
index 97106343..dc783409 100644
17+
--- a/vendor/github.com/nats-io/nats-server/v2/server/auth.go
18+
+++ b/vendor/github.com/nats-io/nats-server/v2/server/auth.go
19+
@@ -586,6 +586,7 @@ func processUserPermissionsTemplate(lim jwt.UserPermissionLimits, ujwt *jwt.User
20+
func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) (authorized bool) {
21+
var (
22+
nkey *NkeyUser
23+
+ ujwt string
24+
juc *jwt.UserClaims
25+
acc *Account
26+
user *User
27+
@@ -729,13 +730,19 @@ func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) (au
28+
29+
// Check if we have trustedKeys defined in the server. If so we require a user jwt.
30+
if s.trustedKeys != nil {
31+
- if c.opts.JWT == _EMPTY_ {
32+
+ ujwt = c.opts.JWT
33+
+ if ujwt == _EMPTY_ && c.isMqtt() {
34+
+ // For MQTT, we pass the password as the JWT too, but do so here so it's not
35+
+ // publicly exposed in the client options if it isn't a JWT.
36+
+ ujwt = c.opts.Password
37+
+ }
38+
+ if ujwt == _EMPTY_ {
39+
s.mu.Unlock()
40+
c.Debugf("Authentication requires a user JWT")
41+
return false
42+
}
43+
// So we have a valid user jwt here.
44+
- juc, err = jwt.DecodeUserClaims(c.opts.JWT)
45+
+ juc, err = jwt.DecodeUserClaims(ujwt)
46+
if err != nil {
47+
s.mu.Unlock()
48+
c.Debugf("User JWT not valid: %v", err)
49+
@@ -995,6 +1002,11 @@ func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) (au
50+
// Hold onto the user's public key.
51+
c.mu.Lock()
52+
c.pubKey = juc.Subject
53+
+ // If this is a MQTT client, we purposefully didn't populate the JWT as it could contain
54+
+ // a password or token. Now we know it's a valid JWT, we can populate it.
55+
+ if c.isMqtt() {
56+
+ c.opts.JWT = ujwt
57+
+ }
58+
c.tags = juc.Tags
59+
c.nameTag = juc.Name
60+
c.mu.Unlock()
61+
diff --git a/vendor/github.com/nats-io/nats-server/v2/server/mqtt.go b/vendor/github.com/nats-io/nats-server/v2/server/mqtt.go
62+
index 7ca49081..f5ef29e6 100644
63+
--- a/vendor/github.com/nats-io/nats-server/v2/server/mqtt.go
64+
+++ b/vendor/github.com/nats-io/nats-server/v2/server/mqtt.go
65+
@@ -3561,7 +3561,6 @@ func (c *client) mqttParseConnect(r *mqttReader, hasMappings bool) (byte, *mqttC
66+
return 0, nil, err
67+
}
68+
c.opts.Token = c.opts.Password
69+
- c.opts.JWT = c.opts.Password
70+
}
71+
return 0, cp, nil
72+
}
73+
--
74+
2.45.4
75+

SPECS/telegraf/telegraf.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: agent for collecting, processing, aggregating, and writing metrics.
22
Name: telegraf
33
Version: 1.31.0
4-
Release: 17%{?dist}
4+
Release: 18%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -35,6 +35,8 @@ Patch20: CVE-2026-4645.patch
3535
# Patch added based on customer request https://microsoft.visualstudio.com/OS/_workitems/edit/61041768
3636
# Fix was introduced 1.37.2, this patch can be removed once we update to 1.37.2 or later
3737
Patch21: cisco_telegraf_bug61041768.patch
38+
Patch22: CVE-2026-29785.patch
39+
Patch23: CVE-2026-33216.patch
3840

3941
BuildRequires: golang
4042
BuildRequires: systemd-devel
@@ -99,6 +101,9 @@ fi
99101
%dir %{_sysconfdir}/%{name}/telegraf.d
100102

101103
%changelog
104+
* Thu Apr 02 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-18
105+
- Patch for CVE-2026-33216, CVE-2026-29785
106+
102107
* Fri Mar 27 2026 Sindhu Karri <lakarri@microsoft.com> - 1.31.0-17
103108
- Added patch to fix the issue reported in https://microsoft.visualstudio.com/OS/_workitems/edit/61041768
104109
Fix in telegraf to support cisco telemetry plugin that collects telemetry data from cisco NXOS switches.

0 commit comments

Comments
 (0)