CVE-2026-58211 Overview
CVE-2026-58211 is an authorization bypass vulnerability in NATS Server, the high-performance messaging system for NATS.io used in cloud and edge native deployments. The flaw allows a client to be registered as the configured no_auth_user through a parser path executed when the first client operation is not CONNECT. This bypasses user-level connection restrictions such as allowed_connection_types and proxy_required that normal authentication would enforce. The issue affects versions prior to 2.14.3 and 2.12.12 and is classified under CWE-863: Incorrect Authorization.
Critical Impact
Remote clients can gain the privileges of the no_auth_user account without satisfying connection-type restrictions, exposing NATS subjects that should require authenticated proxy or transport channels.
Affected Products
- NATS Server versions prior to 2.14.3 (2.14.x branch)
- NATS Server versions prior to 2.12.12 (2.12.x branch)
- Deployments configured with a no_auth_user and per-user connection restrictions
Discovery Timeline
- 2026-07-08 - CVE-2026-58211 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-58211
Vulnerability Analysis
NATS Server supports a no_auth_user configuration that maps unauthenticated clients to a predefined user account. Operators typically restrict this account using allowed_connection_types (for example, limiting it to WebSocket or MQTT) or proxy_required to enforce that connections arrive through a specific transport. These restrictions are applied during the standard CONNECT handshake processing path.
The vulnerability exists because an alternate parser path handles the case where a client issues a non-CONNECT operation as its first protocol message. In that path, the server registers the connection as the no_auth_user without evaluating the connection-type or proxy constraints that the normal handshake enforces. The result is an authorization gap: the client obtains the effective permissions of no_auth_user on a transport that should have rejected it.
Root Cause
The root cause is inconsistent enforcement of user-level connection restrictions across parser code paths. The CONNECT path evaluates allowed_connection_types and proxy_required before user assignment, while the fallback path that handles a first non-CONNECT operation performs no_auth_user assignment without applying those checks. This is a classic [CWE-863] incorrect authorization pattern where two code paths reach the same privileged state through different validation logic.
Attack Vector
An attacker with network access to a NATS listener sends a valid NATS protocol operation other than CONNECT as the first message on the connection. The server routes the session through the vulnerable parser branch and assigns the no_auth_user identity, skipping the transport and proxy restrictions. The attacker then interacts with subjects and streams permitted to that user. Technical specifics are documented in the NATS Server GitHub Security Advisory GHSA-hmmp-q8cx-v964.
Detection Methods for CVE-2026-58211
Indicators of Compromise
- Client sessions authenticated as no_auth_user arriving on transports excluded by allowed_connection_types
- Connections attributed to no_auth_user that did not traverse the configured proxy despite proxy_required being set
- NATS protocol traffic where the first client frame is PUB, SUB, PING, or another non-CONNECT operation
Detection Strategies
- Enable verbose connection logging on NATS Server and alert when no_auth_user accounts appear on unexpected listener types
- Correlate NATS audit logs with network flow data to identify sessions bypassing the proxy tier
- Baseline the expected transport mix for no_auth_user and flag deviations for review
Monitoring Recommendations
- Ingest NATS Server logs into a centralized logging platform and build queries targeting first-operation anomalies
- Track NATS Server versions across the fleet and alert on hosts running builds older than 2.14.3 or 2.12.12
- Monitor subject-level authorization denials and successes tied to the no_auth_user identity for unexpected spikes
How to Mitigate CVE-2026-58211
Immediate Actions Required
- Upgrade NATS Server to version 2.14.3 or 2.12.12, matching the deployed release branch
- Audit configuration files for no_auth_user usage and confirm whether the account is required
- Review recent connection logs for sessions assigned to no_auth_user on restricted transports
Patch Information
The NATS maintainers fixed the issue in NATS Server 2.14.3 and 2.12.12. Both releases apply the connection-type and proxy checks in the parser path that handles a first non-CONNECT operation. Details are available in the NATS Server GitHub Security Advisory.
Workarounds
- Remove the no_auth_user directive from the NATS Server configuration until patching is complete
- Restrict network reachability to NATS listeners so only trusted proxies and clients can establish sessions
- Require explicit authentication for all users by disabling anonymous fallback mappings
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
