Skip to main content

NATS Server CVE-2026-58253

| EUVDEUVD-2026-42375 HIGH
Improper Authentication (CWE-287)
2026-07-06 vendor:ubuntu
Authentication Bypass Nats Server
8.8
CVSS 3.1 · Vendor: vendor:ubuntu
Share

Severity by source

Vendor (vendor:ubuntu) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
vuln.today AI
8.8 HIGH

Route/leafnode ports are internal so AV:A; a single PING triggers it (AC:L) with no credentials (PR:N); crossing into another account's context is S:C, enabling message injection (I:H) with limited read (C:L) and availability (A:L) impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
Low

Lifecycle Timeline

7
Patch available
Jul 08, 2026 - 21:04 EUVD
Analysis Updated
Jul 08, 2026 - 20:28 vuln.today
v3 (cvss_changed)
Source Code Evidence Fetched
Jul 08, 2026 - 20:28 vuln.today
Analysis Updated
Jul 08, 2026 - 20:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 08, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Jul 08, 2026 - 20:22 NVD
8.8 (HIGH)
Analysis Generated
Jul 06, 2026 - 20:16 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Authentication bypass in NATS Server (nats-io/nats-server) lets an unauthenticated attacker on an adjacent network connect to the cluster (route) or leafnode listener and be silently dropped into the privileged no_auth_user account, bypassing the separate route/leafnode authorization. Any server configured with no_auth_user is affected up to the fixed releases (v2.11.16, v2.12.7, v2.14.0), enabling cross-account message injection over the internal route protocol. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach cluster/leafnode listener on adjacent network
Delivery
Open TCP socket, skip CONNECT handshake
Exploit
Send bare PING to trigger no_auth_user fast-path
Execution
Gain no_auth_user account context
Persist
Inject RMSG cross-account messages
Impact
Tamper with account message streams
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The NATS server must be configured with the no_auth_user option set (not a default setting) and must expose a cluster (route) and/or leafnode listener. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L, base 8.8) is internally consistent with the source evidence: no credentials are needed (PR:N), the trigger is trivial (a single PING, AC:L), and scope changes (S:C) because a route-level connection gains access to a user account's security context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a foothold on the internal network reaching a NATS cluster or leafnode port opens a TCP connection and, instead of sending the required CONNECT handshake, sends a bare 'PING'. The server's no_auth_user fast-path treats the peer as the configured privileged account, and the attacker then injects RMSG traffic to publish into accounts it should not have access to. …
Remediation Vendor-released patch: upgrade to v2.11.16, v2.12.7, or v2.14.0 depending on your release line (release notes at https://github.com/nats-io/nats-server/releases/tag/v2.11.16, .../v2.12.7, and .../v2.14.0; advisory GHSA-38x3-76xf-cq45). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all NATS Server instances with no_auth_user configuration; restrict cluster and leafnode listener network access to explicitly trusted networks only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nats Server

View all
CVE-2021-3127 HIGH POC
7.5 Mar 16

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings ar
CVE-2020-26892 CRITICAL
9.8 Nov 06

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are han
CVE-2020-28466 HIGH
7.5 Mar 07

This affects all versions of package github.com/nats-io/nats-server/server. Rated high severity (CVSS 7.5), this vulnera
CVE-2022-24450 HIGH
8.8 Feb 08

NATS nats-server before 2.7.2 has Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remote
CVE-2026-58250 HIGH
7.5 Jul 06

Remote denial of service in the NATS Server (nats-io/nats-server) leafnode subsystem allows unauthenticated attackers to
CVE-2026-58210 HIGH
7.5 Jul 06

Denial of service in NATS Server (nats-server) MQTT handler allows a remote, unauthenticated client to exhaust server me
CVE-2019-13126 HIGH
7.5 Jul 29

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted reques
CVE-2026-58208 HIGH
7.5 Jul 06

Remote denial-of-service in NATS Server (nats-server) affects deployments with the WebSocket listener enabled but MQTT d
CVE-2023-46129 HIGH
7.5 Oct 31

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise,
CVE-2020-26521 HIGH
7.5 Nov 06

The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). Rated high s
CVE-2026-58213 HIGH
7.1 Jul 06

Protocol injection in NATS Server MQTT support allows an authenticated MQTT client to smuggle control characters (tab, n
CVE-2022-26652 MEDIUM
6.5 Mar 10

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStre

Same weakness CWE-287 – Improper Authentication

View all
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8
CVE-2024-53704 CRITICAL POC
9.8
CVE-2015-7755 CRITICAL POC
9.8
CVE-2013-0625 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-58253 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy