CVE-2026-58214: NATS Server Auth Bypass Vulnerability

CVE-2026-58214 Overview

CVE-2026-58214 is an authorization bypass vulnerability in NATS Server, a high-performance messaging system for NATS.io used in cloud and edge native environments. An authenticated MQTT client can subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions. The flaw exposes MQTT Quality of Service level 2 (QoS2) protocol metadata for other sessions within the same account. The issue affects versions prior to 2.14.3 and 2.12.12, and has been assigned CWE-863: Incorrect Authorization.

Critical Impact
Authenticated MQTT clients can bypass subscribe permissions and access QoS2 protocol metadata belonging to other sessions in the same NATS account.

Affected Products

NATS Server versions prior to 2.12.12 (2.12.x branch)
NATS Server versions prior to 2.14.3 (2.14.x branch)
Deployments exposing the MQTT protocol interface to authenticated clients

Discovery Timeline

2026-07-08 - CVE-2026-58214 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58214

Vulnerability Analysis

The vulnerability resides in the MQTT subject-filter handling logic within server/mqtt.go. NATS Server implements MQTT support by mapping MQTT topics to internal NATS subjects. Certain internal subjects are reserved for the server to deliver protocol control messages, including the $MQTT.deliver.pubrel subject family used for QoS2 PUBREL message delivery.

The filter validation logic only blocked subscriptions matching the general mqttSubPrefix prefix. It did not block subscriptions matching the mqttPubRelDeliverySubjectPrefix. An authenticated MQTT client could therefore subscribe to this internal subject family and observe QoS2 protocol metadata for other sessions in the same account.

Root Cause

The root cause is an incomplete deny list in the MQTT subscription filter check. The server validated one internal subject prefix but omitted the PUBREL delivery prefix from the same check. This is a classic authorization gap where a subset of protected resources is not covered by the access control decision, matching [CWE-863].

Attack Vector

The attack requires network access to the MQTT listener and valid MQTT credentials for an account. The attacker connects as an authenticated MQTT client and issues a SUBSCRIBE request whose topic filter maps to the $MQTT.deliver.pubrel.* subject family. The server accepts the subscription despite the account's configured subscribe permissions, and the client begins receiving QoS2 PUBREL metadata for co-tenant sessions in the account.

// Security patch in server/mqtt.go
// [FIXED] Block MQTT subscribe to internal $MQTT.deliver.pubrel subjects
// TODO: (levb: not sure why since one can subscribe to `#` and it'll
// include everything; I guess this would discourage? Otherwise another
// candidate for DO NOT DELIVER prefix list).
-		if strings.HasPrefix(f.filter, mqttSubPrefix) {
+		if strings.HasPrefix(f.filter, mqttSubPrefix) ||
+			strings.HasPrefix(f.filter, mqttPubRelDeliverySubjectPrefix) {
 			f.qos = mqttSubAckFailure
 			continue
 		}

Source: nats-server commit 297b166. The patch extends the internal-subject filter check to include the PUBREL delivery prefix, causing matching subscriptions to fail with mqttSubAckFailure.

Detection Methods for CVE-2026-58214

Indicators of Compromise

MQTT SUBSCRIBE requests referencing topic filters that map to the $MQTT.deliver.pubrel subject family.
NATS server logs showing successful subscriptions on internal $MQTT.* subjects from client connections.
MQTT clients receiving PUBREL-related metadata for message identifiers they did not originate.

Detection Strategies

Audit NATS Server subscription logs for any subscribe operations targeting subjects with the $MQTT.deliver.pubrel prefix.
Correlate MQTT client identifiers with the topic filters they subscribe to, and flag clients subscribing to system-reserved topics.
Compare running NATS Server version against fixed releases 2.12.12 and 2.14.3 during configuration scans.

Monitoring Recommendations

Enable verbose subscription logging on NATS MQTT listeners and forward events to a central logging platform for review.
Alert on subscriptions to any subject beginning with $MQTT. from non-system accounts.
Track MQTT client behavior baselines to detect clients probing internal subject namespaces.

How to Mitigate CVE-2026-58214

Immediate Actions Required

Upgrade NATS Server to version 2.14.3 if running the 2.14.x branch.
Upgrade NATS Server to version 2.12.12 if running the 2.12.x branch.
Review account permissions and restrict MQTT client credentials to only trusted workloads until patching is complete.

Patch Information

The fix is available in NATS Server v2.14.3 and v2.12.12. Technical details are documented in the GitHub Security Advisory GHSA-4g68-3pwx-5vfj and the patches at commit 297b166 and commit 34b0965.

Workarounds

Disable the MQTT listener in the NATS Server configuration if MQTT is not required in the environment.
Restrict MQTT credentials to isolated accounts so that any leaked QoS2 metadata is limited to a single trust boundary.
Rotate MQTT client credentials for accounts shared across multiple tenants after upgrading.

bash

# Configuration example: disable MQTT until patched, or scope accounts tightly
# nats-server.conf
mqtt {
  # Comment out or remove the listen directive to disable MQTT entirely
  # listen: "0.0.0.0:1883"
}

# Verify running version after upgrade
nats-server --version   # expect: nats-server: v2.14.3 or v2.12.12