CVE-2026-58253

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58253", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-29T21:54:30.330Z", "datePublished": "2026-07-08T19:43:13.776Z", "dateUpdated": "2026-07-09T13:35:24.068Z"}, "containers": {"cna": {"title": "NATS Server: Route API Auth Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45"}, {"name": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6"}, {"name": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6"}, {"name": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0"}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"version": "< 2.11.16", "status": "affected"}, {"version": ">= 2.12.0-preview.1, < 2.12.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:43:13.776Z"}, "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}], "source": {"advisory": "GHSA-38x3-76xf-cq45", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T13:35:15.515260Z", "id": "CVE-2026-58253", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:35:24.068Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58253", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:35:15.515260Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:35:19.879Z"}}], "cna": {"title": "NATS Server: Route API Auth Bypass", "source": {"advisory": "GHSA-38x3-76xf-cq45", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.11.16"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.6"}]}], "references": [{"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45", "name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6", "name": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6", "name": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3", "name": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:43:13.776Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58253", "state": "PUBLISHED", "dateUpdated": "2026-07-09T13:35:24.068Z", "dateReserved": "2026-06-29T21:54:30.330Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T19:43:13.776Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nats-server", "vendor": "nats-io", "versions": [{"status": "affected", "version": "< 2.11.16"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "64D69F6E-293C-4D5F-92F6-8479213F7727", "versionEndExcluding": "2.11.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEE2D11B-BD56-4479-A5EB-79F352DA68AB", "versionEndExcluding": "2.12.7", "versionStartIncluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del edge. Antes de las versiones 2.14.0, 2.12.7 y 2.11.16, cuando no_auth_user estaba configurado, una ruta r\u00e1pida del analizador destinada a conexiones de cliente ordinarias tambi\u00e9n pod\u00eda aplicarse a los listeners de ruta o leafnode, permitiendo que un par no autenticado omitiera la autenticaci\u00f3n CONNECT entre servidores y operara con los privilegios asociados a ese tipo de conexi\u00f3n. Este problema est\u00e1 solucionado en las versiones 2.14.0, 2.12.7 y 2.11.16."}], "id": "CVE-2026-58253", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58253", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T13:35:15.515260Z", "version": "2.0.3"}}]}, "published": "2026-07-08T20:16:54.943", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/nats-io/nats-server: NATS Server: Authentication bypass and privilege escalation via parser fast path", "id": "2498261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498261"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "status": "draft"}, "cwe": "CWE-551", "details": ["NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.", "A flaw was found in NATS Server. When the `no_auth_user` configuration is enabled, a parser optimization intended for client connections can inadvertently apply to route or leafnode listeners. This allows an unauthenticated attacker on an adjacent network to bypass inter-server authentication. Consequently, the attacker can operate with the privileges of a trusted connection, leading to a high impact on data integrity."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid enabling the `no_auth_user` configuration in NATS Server. If `no_auth_user` is required, restrict network access to NATS route and leafnode listeners using firewall rules to only trusted hosts and networks. This limits the attack surface by preventing unauthenticated access from adjacent networks. A restart of the NATS server may be required for configuration changes to take effect."}, "name": "CVE-2026-58253", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.14", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-08T19:43:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58253\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58253\nhttps://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6\nhttps://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6\nhttps://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3\nhttps://github.com/nats-io/nats-server/releases/tag/v2.11.16\nhttps://github.com/nats-io/nats-server/releases/tag/v2.12.7\nhttps://github.com/nats-io/nats-server/releases/tag/v2.14.0\nhttps://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45"], "statement": "This Important flaw in NATS Server permits an unauthenticated attacker on an adjacent network to bypass inter-server authentication when the `no_auth_user` configuration is active. This allows the attacker to operate with trusted connection privileges, leading to a high impact on data integrity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0-preview.1,2.12.6)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "nats-server", "source": "cna", "vendor": "nats-io"}, "product": "nats_server", "vendor": "nats"}], "created": "2026-07-09T09:30:04.681979+00:00", "updated": "2026-07-31T14:00:07.180996+00:00", "vendors": ["nats", "nats$PRODUCT$nats_server"]}