6.5

CVE-2026-58252

NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset of it, and queue subscriptions could also affect delivery to legitimate queue consumers. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linuxfoundation ≫ Nats-server Version < 2.11.16
Linuxfoundation ≫ Nats-server Version >= 2.12.0 < 2.12.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.265
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/nats-io/nats-server/releases/tag/v2.11.16
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.12.7
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.0
Release Notes
https://github.com/nats-io/nats-server/commit/8ced85a11497f86704a95d960281480ce037386b
Patch
https://github.com/nats-io/nats-server/commit/a42a6d1e258eb5c3a2190384d31965a4b715e854
Patch
https://github.com/nats-io/nats-server/commit/e611ca9604697b02d8f22beb76037400a9cf72e6
Patch
https://github.com/nats-io/nats-server/security/advisories/GHSA-wh7g-5m82-pmhr
Vendor Advisory