What is the CVSS score of CVE-2026-58253?

CVE-2026-58253 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of NATS Server are affected by CVE-2026-58253?

An authentication bypass in NATS Server allows attackers on adjacent networks to gain unauthorized access to privileged operations and inject messages across accounts, threatening organizations…. A patch is available.

How to fix or mitigate CVE-2026-58253?

Within 24 hours: identify all NATS Server instances with no_auth_user configuration; restrict cluster and leafnode listener network access to explicitly trusted networks only. Within 7 days: disable no_auth_user if operationally feasible; implement network segmentation to isolate NATS infrastructure from adjacent networks. Within 30 days: monitor vendor advisories for patch release and test v2.11.16, v2.12.7, or v2.14.0 in non-production when available.

NATS Server CVE-2026-58253

EUVD-2026-42375 HIGH

Improper Authentication (CWE-287)

2026-07-06 vendor:ubuntu

Authentication Bypass Red Hat Nats Server Suse Linuxfoundation

8.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

vuln.today AI

8.8 HIGH

Route/leafnode ports are internal so AV:A; a single PING triggers it (AC:L) with no credentials (PR:N); crossing into another account's context is S:C, enabling message injection (I:H) with limited read (C:L) and availability (A:L) impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Updated

Jul 08, 2026 - 20:28 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 08, 2026 - 20:28 vuln.today

Analysis Updated

Jul 08, 2026 - 20:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 08, 2026 - 20:22 NVD

8.8 (HIGH)

Analysis Generated

Jul 06, 2026 - 20:16 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Authentication bypass in NATS Server (nats-io/nats-server) lets an unauthenticated attacker on an adjacent network connect to the cluster (route) or leafnode listener and be silently dropped into the privileged no_auth_user account, bypassing the separate route/leafnode authorization. Any server configured with no_auth_user is affected up to the fixed releases (v2.11.16, v2.12.7, v2.14.0), enabling cross-account message injection over the internal route protocol. No public exploit identified at time of analysis, though the vendor's own regression test demonstrates the exact attack.

Technical ContextAI

NATS is a high-performance CNCF messaging system whose server multiplexes several distinct connection kinds on separate listeners: external CLIENT connections, inter-node ROUTER (cluster) connections, LEAF (leafnode) connections, and GATEWAY connections. The no_auth_user convenience option maps unauthenticated client sessions to a named account so external clients can connect without credentials. The root cause is a CWE-287 (Improper Authentication) flaw in the protocol parser (server/parser.go): the no_auth_user fast-path fired whenever the first protocol command was not CONNECT, without checking the connection kind. As a result a route/leafnode/gateway peer that opened a socket and sent 'PING' (or an RMSG) instead of the mandatory CONNECT handshake was treated as the no_auth_user client, sidestepping the dedicated cluster/leafnode authorization block. The fix constrains the fast-path with 'c.kind == CLIENT' and forces ROUTER/LEAF (and gated GATEWAY) connections to always begin with a CONNECT message.

RemediationAI

Vendor-released patch: upgrade to v2.11.16, v2.12.7, or v2.14.0 depending on your release line (release notes at https://github.com/nats-io/nats-server/releases/tag/v2.11.16, .../v2.12.7, and .../v2.14.0; advisory GHSA-38x3-76xf-cq45). If immediate patching is not possible, the most direct compensating control is to remove or unset the no_auth_user option, which closes the fast-path entirely - the trade-off is that legitimate credential-less client access is lost and clients must authenticate. Additionally, restrict the cluster and leafnode listener ports to trusted internal networks only (firewall/security-group rules or bind to internal interfaces) so untrusted adjacent hosts cannot reach them, and ensure route/leafnode authorization blocks are configured; these reduce reachability but do not fix the underlying bypass, so patching remains the durable remediation.