CVE-2026-58209: NATS Server Auth Bypass Vulnerability

CVE-2026-58209 Overview

CVE-2026-58209 is an authorization bypass vulnerability [CWE-863] affecting NATS Server, a high-performance messaging platform for NATS.io used across cloud and edge native environments. The flaw resides in Message Queuing Telemetry Transport (MQTT) delivery paths, where retained message delivery and QoS1+ durable replay did not consistently recheck the concrete original topic before dispatching an MQTT PUBLISH to a subscriber. Subscribers configured with a subscribe deny rule could receive messages whose topics matched that deny rule, breaking the intended access boundary. Versions prior to 2.14.3 and 2.12.12 are affected. The issue is fixed in NATS Server 2.14.3 and 2.12.12.

Critical Impact
Authenticated MQTT clients can receive messages on topics they are explicitly denied from subscribing to, resulting in unauthorized information disclosure through retained message and QoS replay paths.

Affected Products

NATS Server versions prior to 2.14.3
NATS Server versions prior to 2.12.12
Deployments using MQTT with per-subscriber subscribe deny rules

Discovery Timeline

2026-07-08 - CVE-2026-58209 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58209

Vulnerability Analysis

The vulnerability affects the MQTT bridge in NATS Server, specifically the delivery paths responsible for retained messages and QoS1+ durable replay. NATS supports subscribe permissions that let operators deny specific subjects for a given client. During normal PUBLISH-driven delivery, the server evaluates the concrete subject against the client's deny list before writing the message. On the retained and replay paths, the server did not repeat that concrete-subject check before serializing the MQTT PUBLISH frame. A subscriber holding a broad wildcard subscription that overlaps a narrower deny clause could therefore receive individual retained messages or replayed QoS1+ messages on denied subjects. This is an authorization bypass [CWE-863], not a memory-safety issue, and it results in confidentiality loss without affecting integrity or availability.

Root Cause

The root cause is missing enforcement of the client's mperms deny list in the MQTT retained and QoS replay code paths inside server/mqtt.go. The code trusted the earlier subscription-time check and did not revalidate the concrete original topic at delivery time. Because wildcard subscriptions can legitimately overlap a narrower deny rule, this omission allowed denied topics to leak through.

Attack Vector

An attacker must be an authenticated MQTT client with a valid session and a subscription whose wildcard scope overlaps at least one denied subject. When the broker delivers a retained message or replays a stored QoS1+ message matching that overlap, the deny rule is not enforced and the message is delivered. Exploitation is network-based with low attack complexity and requires low privileges.

// Security patch in server/mqtt.go
// [FIXED] MQTT subscribe deny not enforced on retained/QoS replay paths
			// calling serialize.
			continue
		}
+		// A broad wildcard subscription can overlap a subscribe deny clause.
+		c.mu.Lock()
+		denied := c.mperms != nil && c.checkDenySub(string(psub.subject))
+		c.mu.Unlock()
+		if denied {
+			continue
+		}
		var pi uint16
		qos := min(mqttGetQoS(rm.Flags), sub.mqtt.qos)
		if c.mqtt.rejectQoS2Pub && qos == 2 {
// Source: https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356

The patch adds an explicit checkDenySub call against the concrete subject inside the retained and replay delivery loops. If the subject is denied, delivery is skipped with continue (or return on the single-message path), preventing leakage.

Detection Methods for CVE-2026-58209

Indicators of Compromise

MQTT PUBLISH frames delivered to clients on subjects that appear in their subscribe deny configuration.
Retained message delivery events on wildcard subscriptions overlapping deny rules in NATS Server versions prior to 2.14.3 or 2.12.12.
Unexpected QoS1 replay traffic to clients whose ACLs should have blocked the underlying topic.

Detection Strategies

Inventory running NATS Server binaries and confirm the reported version against 2.14.3 and 2.12.12 baselines.
Audit account and user configurations for MQTT clients that combine wildcard subscriptions with narrower deny_subscribe rules, since these are the exploit precondition.
Correlate broker delivery logs with configured deny lists to identify subjects delivered despite an explicit deny.

Monitoring Recommendations

Enable and centralize NATS Server logs, including MQTT session and delivery events, and forward them to a SIEM for topic-level analysis.
Alert on MQTT PUBLISH frames whose subject matches any client's deny_subscribe list.
Track retained message publish and replay counts per account to detect anomalies following a broker upgrade or configuration change.

How to Mitigate CVE-2026-58209

Immediate Actions Required

Upgrade NATS Server to version 2.14.3 or 2.12.12 on all broker nodes, including JetStream replicas and leaf nodes.
Identify MQTT accounts that rely on subscribe deny rules and treat previously delivered retained topics as potentially exposed until upgrade is complete.
Rotate any secrets or sensitive payloads that may have been published to retained topics within the affected time window.

Patch Information

The issue is fixed in NATS Server 2.14.3 and 2.12.12. The fixes are tracked in commits 181b1f51f40b9954c57e9d478e051fb257679356 and 1c429b6fdc5afd4188cc5faf1127f6334896cd87, and detailed in GitHub Security Advisory GHSA-7qmq-8cc4-hxwg. Release notes are available for NATS Server v2.14.3 and NATS Server v2.12.12.

Workarounds

Narrow wildcard subscriptions so they do not overlap any deny_subscribe subject, which removes the exploit precondition.
Disable MQTT retained messages for accounts where retained delivery to denied topics would be sensitive, until the upgrade is applied.
Restrict MQTT ingress to trusted networks and enforce authentication so anonymous or low-trust clients cannot subscribe with broad wildcards.

bash

# Verify installed NATS Server version and upgrade
nats-server --version

# Example: pin container image to a patched release
docker pull nats:2.14.3
docker pull nats:2.12.12

# Example account config avoiding wildcard/deny overlap for MQTT users
# In nats-server.conf
authorization {
  users = [
    { user: "mqtt_client",
      password: "$MQTT_PASS",
      permissions: {
        subscribe: {
          allow: ["tenantA.telemetry.>"],
          deny:  ["tenantA.telemetry.secrets.>"]
        }
      }
    }
  ]
}