CVE-2026-58209: NATS Server MQTT Authorization Bypass via Retained Message Delivery

Technical summary

CVE-2026-58209 is an authorization bypass in NATS Server's MQTT message delivery paths. The vulnerability exists in the handling of retained message delivery and QoS1+ durable replay mechanisms. When NATS redelivers these messages to subscribers, the system does not consistently re-validate the original topic against the subscriber's configured deny rules before sending the MQTT PUBLISH frame. This allows messages whose original topics should trigger a deny rule to be delivered anyway, violating the intended access control policy. The flaw stems from incomplete topic verification in specific code paths (retained and durable replay) that were not subjected to the same deny-rule rechecking performed in normal message flows.

Business impact

For organizations relying on NATS Server's access controls to enforce topic-level message isolation—such as multi-tenant deployments or systems segregating sensitive topics by subscriber role—this vulnerability represents a confidentiality risk. An authenticated user could access information they are not authorized to see through retained messages or durably replayed queues, potentially exposing proprietary data, PII, or system secrets. In cloud and edge environments where NATS is commonly used, this could impact data governance and compliance posture if sensitive topics are supposed to be restricted by role.

Affected systems

NATS Server versions prior to 2.14.3 (all 2.14.x releases before 2.14.3) and prior to 2.12.12 (all 2.12.x releases before 2.12.12) are affected. This includes earlier 2.x release lines. The vulnerability specifically impacts deployments that use MQTT protocol integration with NATS Server and rely on subscribe deny rules to enforce access control. Organizations using only the native NATS protocol without MQTT may have reduced exposure, though the underlying access-check logic may also be present in other code paths.

Exploitability

The vulnerability requires an attacker to be an authenticated subscriber with valid credentials to the NATS Server. This is a low-privilege but authenticated attack. Exploitation does not require user interaction, special network conditions, or interaction with another user. An authenticated subscriber simply needs to receive a retained message or subscribe to a durable queue where messages matching a deny-rule topic are replayed. The attack surface is internal to organizations using NATS, assuming network access controls prevent unauthenticated connections. CVSS 4.3 (Medium) reflects the authenticated requirement and limited impact (confidentiality only, no integrity or availability impact).

Remediation

Upgrade NATS Server to version 2.14.3 or later (for 2.14.x branch) or 2.12.12 or later (for 2.12.x branch). Organizations on earlier 2.x release lines should verify the latest stable version available and upgrade accordingly. Before upgrading, test in a non-production environment to ensure compatibility with existing MQTT client configurations and access control policies. After patching, validate that deny rules are being enforced correctly by conducting targeted testing or reviewing access logs.

Patch guidance

1. Identify all NATS Server instances in your environment and their current versions. 2. Prioritize instances exposed to untrusted or semi-trusted internal users, or those handling sensitive multi-tenant data. 3. Plan a maintenance window and upgrade affected servers to the patched versions (2.14.3+ or 2.12.12+). 4. Review the NATS release notes for any breaking changes or configuration adjustments needed. 5. After patching, restart NATS servers and verify that MQTT client connections re-establish and reconnect successfully. 6. Confirm that deny rules are applied by testing subscriber access to restricted topics using a test MQTT client.

Detection guidance

Monitor NATS Server logs for unusual subscription patterns or deny-rule violations. Configure audit logging if available to track which subscribers receive messages from which topics. Use NATS monitoring endpoints (if exposed only to trusted networks) to inspect subscriber metadata and topic filters. In a multi-tenant scenario, establish baseline metrics of normal retained message and durable queue replay activity, then alert on anomalies. If you suspect exploitation, review historical message delivery logs to identify if any subscriber received messages matching a deny-rule topic. Network-level detection is difficult without inline MQTT inspection; focus on NATS-level logging and access auditing.

Why prioritize this

Although the CVSS score is Medium (4.3), this vulnerability should be prioritized for patching in the near term because: (1) it directly undermines access control enforcement, which is a foundational security control in multi-tenant or role-based environments; (2) exploitation is straightforward for an authenticated insider; (3) the impact is confidentiality loss without warning; and (4) many organizations deploying NATS in cloud or edge scenarios depend on topic-level access control. Do not deprioritize simply because the CVSS is not Critical; the control-plane nature of the flaw warrants timely remediation.

Risk score, explained

CVSS 4.3 Medium is assigned because the vulnerability requires authentication (reducing exploitability), has low complexity, affects only confidentiality (not integrity or availability), and is scoped to the subscriber's view of a single NATS instance. However, the underlying issue—authorization bypass—is more severe in practice than the numeric score suggests, particularly in regulated industries or sensitive deployments. Organizations should assess their own risk based on (1) whether they rely on deny rules to enforce data segregation, (2) the sensitivity of their topics, and (3) whether they have untrusted insiders or external contractors with valid subscriber credentials.

Frequently asked questions