CVE-2026-58214

Published: Jul 8, 2026Modified: Jul 13, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.

Affected (2)

Products: Linuxfoundation: Nats Server

Linuxfoundation

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Nats Server	Before 2.12.12
Linuxfoundation Nats Server	From 2.14.0 to 2.14.3

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (5)

https://github.com/nats-io/nats-server/commit/297b166be60fe13144084eed4b25201ead03204a

Source: security-advisories@github.com

Patch

https://github.com/nats-io/nats-server/commit/34b09657bb596d5f850eaa5cfc97ea6b2f989a97

Source: security-advisories@github.com

Patch

https://github.com/nats-io/nats-server/releases/tag/v2.12.12

Source: security-advisories@github.com

Release Notes

https://github.com/nats-io/nats-server/releases/tag/v2.14.3

Source: security-advisories@github.com

Release Notes

https://github.com/nats-io/nats-server/security/advisories/GHSA-4g68-3pwx-5vfj

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.