CVE-2026-58251: NATS Server Access Control Bypass via Queue Subscriptions

Technical summary

The vulnerability stems from an authorization logic flaw in NATS Server's subscription handling. When evaluating whether a user can subscribe to a topic, the server checks two distinct permission paths: plain subject denies and queue-specific denies. In affected versions, if a user is denied a plain subject via an explicit deny rule, the server may still permit a queue subscription to the same subject if the queue name itself is not explicitly denied. This occurs because queue-specific deny evaluation can override plain subject deny results, violating the expected deny semantics where a plain subject deny should block all subscription types. The vulnerability requires prior authentication, limiting but not eliminating the threat surface.

Business impact

For organizations using NATS as a message broker in sensitive environments, this bypass enables authenticated insiders or compromised application accounts to breach data isolation controls. In multi-tenant architectures, a tenant with legitimate access to some topics could read messages from restricted topics by leveraging queue subscriptions. This undermines the confidentiality guarantees that access control policies are intended to provide. Organizations may need to audit historical queue subscriptions to determine if unauthorized access occurred. Operational impact depends on whether NATS-based deny rules are the primary or sole isolation mechanism for sensitive data.

Affected systems

NATS Server versions prior to 2.14.0 (all 2.14.x versions before .0), 2.12.7, and 2.11.16 are affected. The flaw is specific to the NATS Server component; client libraries themselves are not vulnerable, but they may execute unauthorized subscriptions if deployed against vulnerable server versions. Verify your installed version against the vendor advisory to confirm exposure. Organizations using older maintenance branches should check whether updates are available for their version stream.

Exploitability

Exploitation requires a valid NATS Server account with authentication credentials—public or unauthenticated NATS instances are not at risk via this vector. Once authenticated, an attacker needs knowledge of the restricted topic name and must use a queue subscription syntax to bypass the plain deny rule. This is a low-friction attack once credentials are obtained, as queue subscriptions are a normal NATS feature. The CVSS score of 6.5 (Medium) reflects the authentication requirement and confidentiality impact without integrity or availability compromise. No evidence of public exploit code or active exploitation has been reported.

Remediation

Upgrade to NATS Server 2.14.0, 2.12.7, or 2.11.16 depending on your version branch. These versions correct the authorization logic to ensure plain subject deny rules consistently block subscriptions, regardless of whether a queue name is used. After patching, perform a subscription audit to confirm no unauthorized queue subscriptions exist in production. If immediate patching is not feasible, implement network segmentation to restrict access to NATS cluster endpoints and reduce the number of authenticated principals with high-privilege accounts.

Patch guidance

Download and deploy the patched version corresponding to your current release branch: 2.14.0 or later for the latest line, 2.12.7 for the 2.12.x branch, or 2.11.16 for the 2.11.x branch. Test the patched version in a staging environment replicating your deny rule configuration before rolling out to production. NATS upgrades are typically low-risk but verify compatibility with your client libraries and any custom middleware. Rolling restarts may be performed with minimal downtime in clustered deployments.

Detection guidance

Review NATS Server audit logs for queue subscription attempts by authenticated users to topics subject to deny rules. Monitor for subscription requests with queue names where corresponding plain subject subscriptions were previously denied. Correlate queue subscription patterns with unusual message consumption from restricted topics. Check authorization policy definitions to identify where plain subject denies are active and search logs for any queue-based subscription grants that bypass those denies. A subscription deny rule audit may reveal overly permissive queue-name policies that inadvertently override subject denies.

Why prioritize this

While this is a Medium-severity vulnerability, prioritize patching based on whether you rely on NATS access controls for data isolation in multi-tenant or sensitive environments. If NATS deny rules are enforced as a secondary layer behind application-level access controls, risk is mitigated. If NATS is your primary trust boundary—for instance, in a message-driven microservices platform where different services should not access each other's queues—treat this as high priority. Organizations running NATS on the public internet or with a large number of authenticated users should patch sooner. Less-exposed deployments may defer to the next maintenance window.

Risk score, explained

The CVSS 6.5 (Medium) score reflects a network-accessible vulnerability requiring valid authentication (PR:L) with no special user interaction needed (UI:N). Impact is confidentiality-only (C:H) with no integrity or availability loss; the attacker can read restricted messages but not modify or disrupt the system. The broad network attack vector (AV:N) and low complexity (AC:L) prevent a lower score, but the authentication barrier and absence of system compromise prevent a higher one. For environments where NATS controls access to highly sensitive data, your organization's risk tolerance may warrant treating this as higher priority despite the Medium rating.

Frequently asked questions