CVE-2026-58214

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nats-io/nats-server/commit/297b166be60fe13144084eed4b25201ead03204a	Patch
https://github.com/nats-io/nats-server/commit/34b09657bb596d5f850eaa5cfc97ea6b2f989a97	Patch
https://github.com/nats-io/nats-server/releases/tag/v2.12.12	Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3	Release Notes
https://github.com/nats-io/nats-server/security/advisories/GHSA-4g68-3pwx-5vfj	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:nats-server::::::::
	cpe:2.3:a:linuxfoundation:nats-server::::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajería nativo de la nube y del borde. Antes de las versiones 2.14.3 y 2.12.12, un cliente MQTT autenticado podía suscribirse a la familia de asuntos internos $MQTT.deliver.pubrel, eludiendo los permisos de suscripción configurados y exponiendo metadatos del protocolo MQTT QoS2 para sesiones en la cuenta. Este problema está solucionado en las versiones 2.14.3 y 2.12.12.

Information

Published : 2026-07-08 20:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-58214

Mitre link : CVE-2026-58214

CVE.ORG link : CVE-2026-58214

JSON object : View

Products Affected

linuxfoundation

nats-server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-58214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58214", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:32:18.907165Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.12.12"}, {"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.3"}]}]}], "published": "2026-07-08T20:16:54.347", "references": [{"url": "https://github.com/nats-io/nats-server/commit/297b166be60fe13144084eed4b25201ead03204a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/34b09657bb596d5f850eaa5cfc97ea6b2f989a97", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-4g68-3pwx-5vfj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de las versiones 2.14.3 y 2.12.12, un cliente MQTT autenticado pod\u00eda suscribirse a la familia de asuntos internos $MQTT.deliver.pubrel, eludiendo los permisos de suscripci\u00f3n configurados y exponiendo metadatos del protocolo MQTT QoS2 para sesiones en la cuenta. Este problema est\u00e1 solucionado en las versiones 2.14.3 y 2.12.12."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3662387F-C5A6-478A-94D1-849E3C7E81DB", "versionEndExcluding": "2.12.12"}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BF70729-64AF-4219-BC35-3C5C042F0595", "versionEndExcluding": "2.14.3", "versionStartIncluding": "2.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}