CVE-2026-58252: NATS Server Wildcard-Overlap Subscribe Authz Bypass Vulnerability
Summary
CVE-2026-58252: NATS Server: Subscribe Authz Bypass via Wildcard-Overlap. Affects nats across 2 version ranges.
< 2.11.16
>= 2.12.0, < 2.12.7
Fixed in 2.11.16 or 2.12.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NATS Server is a high-performance messaging server designed for cloud and edge applications. It enables efficient communication between distributed systems, supporting various messaging patterns such as publish/subscribe and request/reply. The server is known for its lightweight architecture and scalability, making it a popular choice for microservices and real-time applications. However, prior to versions 2.14.0, 2.12.7, and 2.11.16, it was susceptible to a security flaw that allowed authenticated users to bypass authorization controls under specific conditions.
Vulnerability Detail
The vulnerability arises from a flaw in the authorization mechanism of NATS Server, where an authenticated user could receive messages on subjects that should have been denied access. This occurred when a wildcard subscription overlapped with a configured wildcard deny rule but was not a strict subset of it. Additionally, queue subscriptions could inadvertently affect message delivery to legitimate consumers. This could lead to unauthorized access to sensitive information and disrupt the intended message flow within applications relying on NATS for communication.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.11.162.11.16 -
>= 2.12.0, < 2.12.72.12.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can review and adjust their wildcard deny rules to ensure they are more restrictive and do not overlap with any wildcard subscriptions that could lead to unauthorized message delivery. This may involve re-evaluating the subscription patterns used in the application.
Conclusion
CVE-2026-58252 highlights a significant security vulnerability in NATS Server that can lead to unauthorized message access. Users are strongly encouraged to update to the latest patched versions to ensure their systems remain secure. Additionally, reviewing subscription patterns can help mitigate risks until an upgrade is performed.
See every vulnerability recorded for nats →
FAQ
The impact includes potential unauthorized access to messages that should be restricted, leading to data leaks and disruption of message delivery.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions 2.14.0, 2.12.7, and 2.11.16 of NATS Server are safe from this vulnerability.
Yes, you can adjust your wildcard deny rules to prevent overlaps with subscriptions, but upgrading is the recommended solution.
NATS Server is used for high-performance messaging in cloud and edge applications, facilitating communication between microservices and distributed systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for nats.
