CVE-2026-58251
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In NATS Server, an authenticated user with subscription deny permissions can bypass a plain subject deny rule by using a queue subscription. This occurs because queue-specific deny evaluation can override the plain subject deny result when the queue name itself is not denied.
Risk Assessment
The organization is at risk of unauthorized access to messages in subjects that should be blocked for a given user. This could lead to sensitive data leakage or violation of message access security policies.
Recommendation
Immediately update NATS Server to version 2.14.0, 2.12.7, or 2.11.16, depending on the release line in use. The update eliminates the possibility of bypassing subject deny rules via queue subscriptions.
Other vulnerabilities in NATS Server
See all- CVE-2026-58211Medium
In NATS Server prior to versions 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply.
- CVE-2026-58208Medium
A vulnerability in NATS Server allows an unauthenticated client to send a WebSocket request for the MQTT protocol even when MQTT is not configured. This leads to access to uninitialized MQTT state and crashes the server process.
- CVE-2026-58207High
A vulnerability in NATS Server before versions 2.14.3 and 2.12.12 allows a client to send connection monitoring requests with pagination Offset and Limit values that cause internal arithmetic overflow, potentially crashing the server.
- CVE-2026-58254Medium
In NATS Server prior to versions 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode operator to send trace events to subjects that would not otherwise be permitted and to use trace-only behavior to prevent normal delivery or storage of affected messages.
- CVE-2026-58253High
In NATS Server, when no_auth_user is configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type.
- CVE-2026-58252Medium
A vulnerability in NATS Server allows an authenticated user to receive messages on denied subjects when a wildcard subscription overlaps with a configured wildcard deny rule but is not a subset of it. Additionally, queue subscriptions can affect delivery to legitimate queue consumers.
- CVE-2026-58250High
In NATS Server before versions 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server by sending repeated leafnode INFO protocol messages before authentication and account setup completed.
- CVE-2026-58214Medium
In NATS Server before versions 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account.
- CVE-2026-58213High
A vulnerability in the NATS Server allows an MQTT client to inject protocol control characters into subscription filters, which are later forwarded as NATS protocol data to route or leafnode connections, potentially corrupting the protocol stream and enabling unauthorized NATS operations.
- CVE-2026-58210High
An unauthenticated MQTT client can cause the NATS server to retain large incomplete MQTT CONNECT packets before authentication completes, consuming server memory while waiting for the advertised packet length. This affects versions prior to 2.14.3 and 2.12.12.
Original NVD description (English source)
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.