CVE-2026-58253: NATS Server Auth Bypass Vulnerability

CVE-2026-58253 Overview

CVE-2026-58253 is an authentication bypass vulnerability [CWE-287] in NATS Server, the high-performance messaging system for NATS.io cloud and edge native deployments. When operators configure the no_auth_user option, a parser fast path intended for ordinary client connections incorrectly extends to route and leafnode listeners. An unauthenticated peer on an adjacent network can bypass inter-server CONNECT authentication and operate with the privileges tied to that connection type. The flaw affects versions prior to 2.14.0, 2.12.7, and 2.11.16.

Critical Impact
Unauthenticated attackers with adjacent network access can join a NATS cluster as a route or leafnode peer, gaining inter-server privileges to publish, subscribe, and disrupt message flow across the mesh.

Affected Products

NATS Server versions prior to 2.11.16
NATS Server versions prior to 2.12.7
NATS Server versions prior to 2.14.0

Discovery Timeline

2026-07-08 - CVE CVE-2026-58253 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58253

Vulnerability Analysis

NATS Server exposes multiple listener types: client listeners for application connections, route listeners for full-mesh server-to-server communication, and leafnode listeners for hub-and-spoke topologies. Each listener enforces its own CONNECT authentication handshake before granting protocol access. The no_auth_user option was designed to map unauthenticated client connections to a default user account, enabling frictionless demos and telnet-style testing.

The parser inside server/parser.go contains a fast path that permits non-CONNECT protocol messages as the first frame when no_auth_user is set. This fast path failed to verify the connection kind before applying. Route and leafnode peers, which should always require explicit inter-server authentication, could reach this branch and inherit the no_auth_user identity. The result is authentication bypass at the routing layer, granting an attacker the ability to inject subjects, subscribe to sensitive topics, or manipulate cluster state.

Root Cause

The root cause is a missing connection-kind check in the parser's no_auth_user handling. The code applied the client-facing shortcut universally instead of gating it to c.kind == CLIENT, so route and leafnode listeners consumed the same code path.

Attack Vector

Exploitation requires adjacent network access to a NATS route or leafnode listener with no_auth_user configured on the target server. The attacker opens a TCP connection to the route or leafnode port and sends a non-CONNECT protocol message as the first frame. The parser accepts the frame, applies the no_auth_user mapping, and treats the peer as an authenticated inter-server participant.

// Source: https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6
					var ok bool
					// Check here for NoAuthUser. If this is set allow non CONNECT protos as our first.
					// E.g. telnet proto demos.
-					if noAuthUser := s.getOpts().NoAuthUser; noAuthUser != _EMPTY_ {
+					if noAuthUser := s.getOpts().NoAuthUser; noAuthUser != _EMPTY_ && c.kind == CLIENT {
						s.mu.Lock()
						user, exists := s.users[noAuthUser]
						s.mu.Unlock()

The patch adds the c.kind == CLIENT guard, restricting the no_auth_user fast path to client listeners only.

Detection Methods for CVE-2026-58253

Indicators of Compromise

Route or leafnode connections from unexpected source IP addresses in nats-server logs
Successful non-CONNECT protocol frames processed on route (:6222) or leafnode (:7422) ports before an authenticated handshake
Unexplained subscribers or publishers on internal subjects ($SYS.>, _INBOX.>) originating from remote peers
New cluster members appearing in varz or routez endpoints without corresponding configuration changes

Detection Strategies

Enable verbose and trace logging on NATS Server and alert on connections that skip the CONNECT protocol on route or leafnode listeners
Correlate NATS monitoring endpoint output (/routez, /leafz) against an approved allowlist of cluster peers
Deploy network sensors on route and leafnode ports to flag TCP sessions from source addresses outside the cluster subnet

Monitoring Recommendations

Ingest NATS Server logs and monitoring endpoint metrics into a centralized SIEM or data lake for anomaly analysis
Track counts of authenticated versus unauthenticated protocol frames per listener type over time
Alert on any subscription to $SYS.> system subjects from non-administrative accounts

How to Mitigate CVE-2026-58253

Immediate Actions Required

Upgrade NATS Server to 2.11.16, 2.12.7, or 2.14.0 on every node in the cluster
Audit all server configurations for the presence of no_auth_user and confirm whether it is required
Restrict route and leafnode listener ports at the firewall to known cluster peer addresses only
Rotate any credentials or tokens that may have been exposed through unauthorized cluster access

Patch Information

The maintainers released fixes in NATS Server v2.11.16, v2.12.7, and v2.14.0. Technical background is documented in GitHub Security Advisory GHSA-38x3-76xf-cq45. The fix is a one-line guard in server/parser.go that limits the no_auth_user fast path to connections where c.kind == CLIENT.

Workarounds

Remove the no_auth_user directive from nats-server configuration until the upgrade is applied
Bind route and leafnode listeners to management interfaces only and enforce mTLS between cluster peers
Require explicit authorization blocks with strong tokens or NKeys on all route and leafnode listeners

bash

# Configuration example: enforce authenticated cluster peers and remove no_auth_user
cluster {
  listen: 127.0.0.1:6222
  authorization {
    user: route_user
    password: "$2a$11$..."  # bcrypt hash
    timeout: 2
  }
  tls {
    cert_file: "/etc/nats/route-cert.pem"
    key_file:  "/etc/nats/route-key.pem"
    ca_file:   "/etc/nats/ca.pem"
    verify:    true
  }
}

leafnodes {
  listen: 127.0.0.1:7422
  authorization {
    user: leaf_user
    password: "$2a$11$..."
    timeout: 2
  }
}

# Remove or comment out any global no_auth_user setting
# no_auth_user: demo