CVE-2026-58252: NATS Server Authorization Bypass via Wildcard Subscription Overlap

Technical summary

The vulnerability stems from incomplete authorization enforcement in NATS Server's subscription handling logic. When a wildcard subscription pattern (e.g., 'foo.*') overlaps partially with a wildcard deny rule (e.g., 'foo.bar.*'), the server fails to properly validate that the subscription is actually denied. The flaw is compounded by queue subscription semantics, where message delivery to queue groups can bypass intended access controls. This is classified as an authorization/authentication flaw (CWE-285) rather than a direct authentication failure—the user is authenticated, but access decisions are incorrectly applied to their subscriptions. The CVSS 3.1 score of 6.5 (MEDIUM) reflects that exploitation requires valid credentials and does not impact confidentiality at scale, though it does enable information disclosure.

Business impact

For organizations using NATS as a message broker in production environments—particularly in cloud-native, edge, or IoT deployments—this vulnerability creates a compliance and data governance risk. A disgruntled or compromised employee with valid NATS credentials could access sensitive application data, internal events, or configuration information that should be restricted to specific roles. In multi-tenant or federated NATS deployments, this could lead to cross-team or cross-customer data leakage. The impact is primarily confidential information exposure; message integrity and service availability are not directly affected. Remediation requires patching and potential credential rotation if unauthorized access is suspected.

Affected systems

NATS Server versions 2.11.x prior to 2.11.16, 2.12.x prior to 2.12.7, and 2.13.x and earlier are vulnerable. Fixed versions are 2.11.16, 2.12.7, and 2.14.0. Organizations running NATS Server in Docker containers, Kubernetes (via Helm or operators), or on-premises should audit their current version immediately. The impact is isolated to NATS Server itself; clients that use NATS libraries are not directly vulnerable but are exposed if their NATS Server broker is unpatched.

Exploitability

Exploitation is straightforward for any authenticated user with valid NATS credentials and knowledge of the target's subscription namespace. No special privileges, code execution, or network positioning are required beyond initial authentication. The likelihood of accidental discovery is moderate—a user would notice they can subscribe to restricted subjects during normal testing or exploration. The attack is deterministic and repeatable once a wildcard overlap is identified. However, real-world exploitation risk depends on whether organizations enforce strict subject-level ACLs and monitor subscription patterns. In environments with permissive default allow-all policies, this vulnerability may go unnoticed.

Remediation

Upgrade NATS Server to version 2.11.16, 2.12.7, or 2.14.0 or later, depending on your current minor version. Verify against the official NATS release notes before deploying. After patching, review and validate your authorization policy configuration to ensure wildcard deny rules are correctly specified and cover your intended protected subjects. Consider implementing monitoring or auditing of subscription patterns to detect unauthorized access attempts, especially in sensitive environments. If you suspect unauthorized access occurred before patching, audit NATS Server logs (if available) and review application event streams for anomalous message consumption.

Patch guidance

Plan patching in phases: (1) Test the target patch version in a staging environment that mirrors your production NATS cluster topology and workload; (2) Verify that existing subscriptions and queue groups continue to function as expected after upgrade; (3) For production deployments, schedule patching during a maintenance window, though NATS Server restarts should generally have minimal application impact if clients implement proper reconnection logic; (4) After patching, validate a representative sample of your authorization rules by attempting subscriptions that should be denied; (5) Update your infrastructure-as-code and container images to the fixed version to prevent regression in future deployments. Check the NATS GitHub releases page and your package manager for the exact patched versions available in your distribution.

Detection guidance

In environments where NATS Server audit logging is enabled, search logs for subscription attempts on subjects that match the overlap pattern between a user's allowed subscriptions and a deny rule. Look for repeated CONNECT events from a single credential followed by SUB commands on protected subjects. If you lack direct NATS Server logging, monitor application-level metrics: unusual message consumption patterns, sudden spikes in message volume to unexpected topics, or consumers receiving messages from subjects they should not have access to. In Kubernetes environments, enable audit logging on the NATS StatefulSet and review events in the cluster. For queue-based attacks, cross-reference queue subscriber lists against your authorization matrix to identify mismatches.

Why prioritize this

This vulnerability merits prompt patching—within 1–2 weeks—because it requires only valid credentials to exploit and leads to information disclosure in environments where subject-level access control is enforced. While not critical (no remote code execution, denial of service, or data corruption), it directly undermines the trust boundary between authenticated users and protected data. Prioritize environments that handle regulated data (PII, healthcare, financial) or multi-tenant SaaS platforms where data isolation is a contract requirement. Environments with very permissive NATS policies may pose lower risk but should still patch to comply with least-privilege principles.

Risk score, explained

CVSS 3.1 6.5 (MEDIUM) reflects: Attack Vector Network (low barrier to entry), Attack Complexity Low (no special conditions required), Privileges Required (attacker must be authenticated), User Interaction None, Scope Unchanged (impact is limited to NATS), Confidentiality Impact High (authorized message interception), Integrity Impact None, and Availability Impact None. The score appropriately captures that while this is a real authorization flaw with meaningful business impact, it does not enable lateral movement, privilege escalation, or service disruption on its own. Real-world severity should be elevated to HIGH in environments handling highly sensitive data or where regulatory obligations demand strict role-based access controls.

Frequently asked questions