CVE-2026-58251

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c	Patch
https://github.com/nats-io/nats-server/commit/79c2f6e9ff87f594596337b6427dda85c38d1fe1	Patch
https://github.com/nats-io/nats-server/commit/b9ffb63b85e7db3d25a13b2e234f5f7f7c13164d	Patch
https://github.com/nats-io/nats-server/releases/tag/v2.11.16	Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.12.7	Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.0	Release Notes
https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:nats-server::::::::
	cpe:2.3:a:linuxfoundation:nats-server::::::::

History

No history.

Information

Published : 2026-07-08 20:16

Updated : 2026-07-13 15:23

NVD link : CVE-2026-58251

Mitre link : CVE-2026-58251

CVE.ORG link : CVE-2026-58251

JSON object : View

Products Affected

linuxfoundation

nats-server

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-58251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58251", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:40:09.306056Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.11.16"}, {"status": "affected", "version": ">= 2.12.0-RC.1, < 2.12.7"}]}]}], "published": "2026-07-08T20:16:54.630", "references": [{"url": "https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/79c2f6e9ff87f594596337b6427dda85c38d1fe1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/b9ffb63b85e7db3d25a13b2e234f5f7f7c13164d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}], "lastModified": "2026-07-13T15:23:31.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64D69F6E-293C-4D5F-92F6-8479213F7727", "versionEndExcluding": "2.11.16"}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEE2D11B-BD56-4479-A5EB-79F352DA68AB", "versionEndExcluding": "2.12.7", "versionStartIncluding": "2.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}