CVE-2026-58213

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58213", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-29T17:09:25.873Z", "datePublished": "2026-07-08T19:52:12.148Z", "dateUpdated": "2026-07-09T13:33:07.155Z"}, "containers": {"cna": {"title": "NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f"}, {"name": "https://github.com/nats-io/nats-server/pull/8163", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/pull/8163"}, {"name": "https://github.com/nats-io/nats-server/pull/8164", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/pull/8164"}, {"name": "https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8"}, {"name": "https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736"}, {"name": "https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.9"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.1"}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"version": "< 2.12.9", "status": "affected"}, {"version": ">= 2.14.0-RC.1, < 2.14.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:52:12.148Z"}, "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9."}], "source": {"advisory": "GHSA-qrcv-3558-gj4f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T13:32:57.416842Z", "id": "CVE-2026-58213", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:33:07.155Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection", "source": {"advisory": "GHSA-qrcv-3558-gj4f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.12.9"}, {"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.1"}]}], "references": [{"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f", "name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nats-io/nats-server/pull/8163", "name": "https://github.com/nats-io/nats-server/pull/8163", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/pull/8164", "name": "https://github.com/nats-io/nats-server/pull/8164", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8", "name": "https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736", "name": "https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9", "name": "https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.9", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.1", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:52:12.148Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58213", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:32:57.416842Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-09T13:33:03.380Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-58213", "state": "PUBLISHED", "dateUpdated": "2026-07-08T19:52:12.148Z", "dateReserved": "2026-06-29T17:09:25.873Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T19:52:12.148Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nats-server", "vendor": "nats-io", "versions": [{"status": "affected", "version": "< 2.12.9"}, {"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "0651D3C8-4F2C-4FEF-B264-45666C245161", "versionEndExcluding": "2.12.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "44BD65FC-1D42-479F-9289-BF14FED5A7E7", "versionEndExcluding": "2.14.1", "versionStartIncluding": "2.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de 2.14.1 y 2.12.9, un cliente MQTT pod\u00eda incluir caracteres de control de protocolo en filtros de suscripci\u00f3n que luego eran reenviados como datos del protocolo NATS a conexiones de ruta o de nodo hoja, corrompiendo el flujo del protocolo reenviado y permitiendo la inyecci\u00f3n de operaciones de protocolo NATS no intencionadas. Este problema est\u00e1 solucionado en las versiones 2.14.1 y 2.12.9."}], "id": "CVE-2026-58213", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58213", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T13:32:57.416842Z", "version": "2.0.3"}}]}, "published": "2026-07-08T20:16:54.180", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nats-io/nats-server/pull/8163"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nats-io/nats-server/pull/8164"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.9"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.12.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.0-RC.1,2.14.1)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "nats-server", "source": "cna", "vendor": "nats-io"}, "product": "nats_server", "vendor": "nats"}], "created": "2026-07-09T09:30:04.679121+00:00", "updated": "2026-08-01T15:45:04.327090+00:00", "vendors": ["nats", "nats$PRODUCT$nats_server"]}