CVE-2026-58251: NATS Server Auth Bypass Vulnerability

CVE-2026-58251 Overview

CVE-2026-58251 is an authorization bypass vulnerability [CWE-285] in NATS Server, a high-performance messaging system for NATS.io used in cloud and edge native environments. An authenticated user with subscription deny permissions can bypass a plain subject deny rule by using a queue subscription. The flaw occurs because queue-specific deny evaluation overrides the plain subject deny result when the queue name itself is not denied. The issue affects versions prior to 2.14.0, 2.12.7, and 2.11.16.

Critical Impact
Authenticated users can subscribe to subjects that should be denied by policy, resulting in unauthorized access to confidential message streams over the NATS messaging fabric.

Affected Products

NATS Server versions prior to 2.11.16
NATS Server versions prior to 2.12.7
NATS Server versions prior to 2.14.0

Discovery Timeline

2026-07-08 - CVE-2026-58251 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58251

Vulnerability Analysis

The vulnerability resides in the subscription permission evaluation logic in server/client.go. NATS Server evaluates deny rules against both plain subject subscriptions and queue subscriptions. When a client attempts a queue subscription, the server matches the subject against the deny list and then separately evaluates whether the queue name matches a queue-specific deny.

The defect is a logic ordering issue. The queue evaluation unconditionally reassigns the allowed variable based only on whether the queue name matches a denied queue. If the plain subject was denied but the queue name was not explicitly denied, the queue check overwrites the deny decision with an allow.

An authenticated user with limited subscription rights can attach any queue name to a denied subject and receive messages. The result is confidentiality loss on subjects that administrators believed were locked down through subject deny policies.

Root Cause

The root cause is missing short-circuit logic when combining plain subject deny results with queue-specific deny results. The queue evaluation branch executes even when the subject-level deny has already set allowed to false, allowing the queue match logic to promote a denied subscription back to allowed.

Attack Vector

An attacker requires authenticated access with subscription permissions to the NATS Server. The attacker submits a queue subscription for a subject that is present in their deny list, using an arbitrary queue name that is not itself denied. The server evaluates the queue path and returns an allow decision, delivering messages published to the denied subject.

// Patch from server/client.go
// Source: https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c
		r := c.perms.sub.deny.Match(subject)
		allowed = len(r.psubs) == 0

-		if queue != _EMPTY_ && len(r.qsubs) > 0 {
+		if allowed && queue != _EMPTY_ && len(r.qsubs) > 0 {
 			// If the queue appears in the deny list, then DO NOT allow.
 			allowed = !queueMatches(queue, r.qsubs)
 		}

The fix adds the allowed && guard so the queue-specific deny check runs only when the plain subject deny has not already rejected the subscription.

Detection Methods for CVE-2026-58251

Indicators of Compromise

Queue subscription requests from authenticated users targeting subjects that appear in their configured deny lists.
NATS Server logs showing successful SUB operations on sensitive subjects paired with arbitrary or unusual queue group names.
Unexpected message delivery to clients whose account permissions include an explicit subject-level deny.

Detection Strategies

Audit NATS Server subscription logs and correlate subject and queue fields against the configured account permission policies.
Enable subscription-level trace logging on NATS Server and review whether denied subjects are being delivered when a queue name is present.
Review account and user permission configurations for subject denies that could be bypassed through queue subscriptions.

Monitoring Recommendations

Ship NATS Server logs to a centralized logging platform and alert on SUB events where the subject matches a documented deny rule.
Baseline expected queue group names per account and alert on new or unexpected queue names used by low-privilege clients.
Monitor egress message volume from NATS Server per client identity to detect anomalous consumption of sensitive subjects.

How to Mitigate CVE-2026-58251

Immediate Actions Required

Upgrade NATS Server to 2.11.16, 2.12.7, or 2.14.0 depending on your current release track.
Inventory all NATS Server deployments including sidecars, embedded servers, and leaf nodes to ensure every instance is patched.
Rotate credentials for any account that had subject-level denies for confidential subjects, since those subjects may have been exposed.

Patch Information

The fix is available in GitHub Release v2.11.16, GitHub Release v2.12.7, and GitHub Release v2.14.0. Technical details are documented in the GitHub Security Advisory GHSA-jx8g-9g95-6322. The code change is committed in commit 01358628.

Workarounds

Where upgrade is not immediately feasible, add explicit queue-level deny rules that cover wildcard queue names for every denied subject.
Restrict subscription permissions to an explicit allow list rather than relying solely on deny rules, so users cannot subscribe to unlisted subjects.
Segment sensitive subjects into dedicated accounts with no cross-account exports to limit the blast radius of the bypass.

bash

# Verify installed NATS Server version and upgrade
nats-server --version

# Example: upgrade using container image
docker pull nats:2.14.0
docker stop nats-server && docker rm nats-server
docker run -d --name nats-server -p 4222:4222 nats:2.14.0

# Example allow-list-based permissions in server config
# accounts.conf
users = [
  { user: "consumer", password: "***",
    permissions: {
      subscribe: {
        allow: ["public.>", "telemetry.public.>"]
      }
    }
  }
]