CVE-2026-58252: NATS Server Auth Bypass Vulnerability

CVE-2026-58252 Overview

CVE-2026-58252 is an authorization flaw in NATS Server, the high-performance messaging system for NATS.io used in cloud and edge native deployments. The server failed to correctly enforce subject deny rules when a client's wildcard subscription overlapped with, but was not a strict subset of, a configured wildcard deny pattern. Authenticated users could subscribe to subjects that partially intersected a denied namespace and receive messages that should have been blocked. Queue subscriptions were also affected, disrupting delivery to legitimate queue consumers. The issue is classified as an improper authorization weakness [CWE-285] and is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

Critical Impact
An authenticated NATS client can receive messages published to denied subjects by crafting an overlapping wildcard subscription, breaking message-level access control in multi-tenant NATS deployments.

Affected Products

NATS Server versions prior to 2.11.16 (2.11.x branch)
NATS Server versions prior to 2.12.7 (2.12.x branch)
NATS Server versions prior to 2.14.0 (2.13.x and earlier 2.14 pre-releases)

Discovery Timeline

2026-07-08 - CVE-2026-58252 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58252

Vulnerability Analysis

NATS Server uses subject-based publish/subscribe semantics, where administrators can define allow and deny rules that constrain which subjects a client may publish to or subscribe from. Deny rules may themselves contain wildcards such as foo.* or foo.>.

The pre-patch logic decided whether to activate the per-message deny filter (mperms) for a wildcard subscription by checking whether the subscribed subject was a strict subset of a denied pattern. Overlapping wildcards that did not fall entirely inside a denied pattern were treated as fully allowed. As a result, messages published to denied subjects that also matched the client's subscription were delivered.

The same code path governs queue subscriptions, so the flaw also perturbed delivery among legitimate queue consumers when a queue subscriber's subject overlapped a deny rule.

Root Cause

The root cause is an incorrect subject-matching predicate in server/client.go. The server evaluated subjectIsSubsetMatch(sub, subject) to decide when to load the message deny filter. Subset matching returns true only when the subscribed subject is entirely contained within the deny pattern, missing partial overlaps such as a subscription on a.> overlapping a deny on a.b.>.

Attack Vector

An authenticated user with permission to create subscriptions submits a wildcard subscription whose subject space intersects a denied wildcard pattern without being a subset of it. Because the server does not activate the per-message deny filter for that subscription, published messages matching the denied pattern are forwarded to the subscriber over an existing network session.

// Patch: server/client.go — enforce deny on overlapping wildcard subjects
// We use the actual subscription to signal us to spin up the deny mperms
// and cache. We check if the subject is a wildcard that intersects any of
// the deny clauses.
if allowed && c.mperms == nil && subjectHasWildcard(subject) {
    // Whip through the deny array and check if this wildcard subject can
    // overlap with any denied deliveries.
    for _, sub := range c.darray {
        if SubjectsCollide(sub, subject) {
            c.loadMsgDenyFilter()
            break
        }
    }
}
// Source: https://github.com/nats-io/nats-server/commit/8ced85a11497f86704a95d960281480ce037386b

The fix replaces subjectIsSubsetMatch with SubjectsCollide, which returns true when two subject patterns share any concrete subject, ensuring the deny filter is engaged whenever an overlap exists.

Detection Methods for CVE-2026-58252

Indicators of Compromise

NATS Server logs showing subscriptions on wildcard subjects (> or *) from accounts that also have configured deny_subscribe rules on overlapping wildcards.
Message delivery to clients on subjects that appear in an account's deny_subscribe or subscribe.deny list.
Unexpected traffic patterns where consumers in one tenant receive messages published by another tenant on restricted subjects.

Detection Strategies

Audit nats-server configuration and per-account permissions for wildcard deny_subscribe rules, then correlate active subscriptions from nats server report connz --subs against those deny patterns.
Compare each active subscription subject to every deny pattern using a collision check (not a subset check) to identify subscriptions that would have bypassed enforcement pre-patch.
Review JetStream and core NATS message accounting for deliveries whose subjects match a denied pattern for the receiving client's account.

Monitoring Recommendations

Enable NATS Server debug or trace logging for subscription creation and message delivery in sensitive accounts, and forward logs to a centralized analytics platform.
Alert on newly created wildcard subscriptions from any account with active deny rules, and on any delivery event whose subject matches a configured deny pattern.
Track the running NATS Server version across the fleet and flag any node below 2.11.16, 2.12.7, or 2.14.0.

How to Mitigate CVE-2026-58252

Immediate Actions Required

Upgrade every NATS Server instance to 2.11.16, 2.12.7, or 2.14.0 or later, matching the branch in use.
Rotate credentials for any account whose deny rules protect sensitive subjects, since prior deliveries cannot be retroactively revoked.
Review account and user permissions to confirm that deny rules reflect the intended access model, and remove overly broad wildcard subscriptions where possible.

Patch Information

The vendor released fixed builds in NATS Server Release v2.11.16, NATS Server Release v2.12.7, and NATS Server Release v2.14.0. The code fix is described in GitHub Security Advisory GHSA-wh7g-5m82-pmhr and applied across commits 8ced85a, a42a6d1, and e611ca9.

Workarounds

Where upgrade is not immediately possible, tighten deny rules to explicit non-wildcard subjects so that subset and collision checks produce the same result.
Restrict client permissions to non-wildcard allow_subscribe subjects, preventing clients from creating overlapping wildcard subscriptions in the first place.
Isolate sensitive subjects into dedicated NATS accounts so cross-account deny bypass is not reachable by lower-trust clients.

bash

# Example: constrain a user to explicit subjects and disallow wildcard subscribe
# nats-server.conf
authorization {
  users = [
    {
      user: "tenant_a"
      password: "..."
      permissions {
        subscribe {
          allow: ["tenant_a.events.orders", "tenant_a.events.audit"]
          deny:  ["tenant_a.events.secrets.>"]
        }
        publish {
          allow: ["tenant_a.events.>"]
        }
      }
    }
  ]
}