What is the CVSS score of CVE-2026-58213?

CVE-2026-58213 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of NATS Server are affected by CVE-2026-58213?

NATS Server MQTT support contains a protocol injection vulnerability (CVE-2026-58213, CVSS 7.1) allowing authenticated clients to smuggle control characters that corrupt message routing in leaf node…. A patch is available.

How to fix or mitigate CVE-2026-58213?

Within 24 hours: Identify all NATS Server deployments, versions, and MQTT/leaf node configurations in your environment. Within 7 days: Upgrade to nats-server v2.12.9 (for 2.12.x) or v2.14.1 (for 2.14.x) on all affected systems, testing in staging first. Within 30 days: Complete production upgrades and validate message routing behavior across all leaf node connections.

NATS Server CVE-2026-58213

EUVD-2026-42383 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-06 vendor:ubuntu

Information Disclosure Red Hat Nats Server Linuxfoundation

7.1

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Authenticated MQTT publish gives PR:L; dependence on MQTT plus leaf-node forwarding raises AC:H; injection crosses into the leaf node connection's subject space, so S:C with C:H, I:L.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Updated

Jul 08, 2026 - 20:32 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 08, 2026 - 20:32 vuln.today

Analysis Updated

Jul 08, 2026 - 20:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 08, 2026 - 20:22 NVD

7.1 (HIGH)

Analysis Generated

Jul 06, 2026 - 20:18 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Protocol injection in NATS Server MQTT support allows an authenticated MQTT client to smuggle control characters (tab, newline, carriage return, form feed) inside publish and Will topics, which corrupt the NATS wire protocol when the topic is converted to a NATS subject and forwarded across leaf node connections. Fixed in nats-server v2.12.9 and v2.14.1, the flaw (GHSA-qrcv-3558-gj4f, CWE-74) is tagged Information Disclosure and lets a low-privileged publisher influence how messages are framed and routed to other connections. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

NATS Server is a high-performance cloud-native messaging system (CNCF) that also speaks MQTT and bridges MQTT topics into its own text-based line protocol. The root cause is CWE-74 (improper neutralization of special elements / injection): mqttParsePub and mqttParseConnect validated topics only with mqttValidateTopic, which did not reject whitespace and framing control bytes. When an MQTT topic is translated via mqttTopicToNATSPubSubject into a NATS subject and that subject is emitted onto a leaf node connection (e.g. as an HMSG control line), embedded \t \n \r \f characters break the space/CRLF-delimited NATS protocol grammar. The patch introduces mqttValidatePublishTopic, which additionally rejects those characters on the publish path only - subscribe/unsubscribe filters keep the old behavior so per-filter conversion still returns a SUBACK failure rather than disconnecting the client.

RemediationAI

Vendor-released patch: upgrade to nats-server v2.12.9 (2.12.x line) or v2.14.1 (2.14.x line), which add mqttValidatePublishTopic to reject framing control characters in MQTT publish and Will topics (see fix commits 366837c, 64ebae4, f14856b and pull requests https://github.com/nats-io/nats-server/pull/8163 and https://github.com/nats-io/nats-server/pull/8164, plus advisory https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f). If immediate upgrade is not possible, reduce exposure by disabling the MQTT listener (the mqtt config block) where MQTT is not required, which removes the injection surface entirely at the cost of MQTT client connectivity; where MQTT is needed, tighten authentication and per-account publish permissions to trusted clients only and avoid bridging untrusted MQTT accounts into leaf node topologies, accepting that this constrains legitimate federation but limits which principals can reach the vulnerable forwarding path.