{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58253", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-29T21:54:30.330Z", "datePublished": "2026-07-08T19:43:13.776Z", "dateUpdated": "2026-07-09T13:35:24.068Z"}, "containers": {"cna": {"title": "NATS Server: Route API Auth Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45"}, {"name": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6"}, {"name": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6"}, {"name": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0"}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"version": "< 2.11.16", "status": "affected"}, {"version": ">= 2.12.0-preview.1, < 2.12.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:43:13.776Z"}, "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}], "source": {"advisory": "GHSA-38x3-76xf-cq45", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T13:35:15.515260Z", "id": "CVE-2026-58253", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:35:24.068Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58253", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:35:15.515260Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:35:19.879Z"}}], "cna": {"title": "NATS Server: Route API Auth Bypass", "source": {"advisory": "GHSA-38x3-76xf-cq45", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.11.16"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.6"}]}], "references": [{"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45", "name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6", "name": "https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6", "name": "https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3", "name": "https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:43:13.776Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58253", "state": "PUBLISHED", "dateUpdated": "2026-07-09T13:35:24.068Z", "dateReserved": "2026-06-29T21:54:30.330Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T19:43:13.776Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "github.com/nats-io/nats-server: NATS Server: Authentication bypass and privilege escalation via parser fast path", "id": "2498261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498261"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "status": "draft"}, "cwe": "CWE-551", "details": ["NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.", "A flaw was found in NATS Server. When the `no_auth_user` configuration is enabled, a parser optimization intended for client connections can inadvertently apply to route or leafnode listeners. This allows an unauthenticated attacker on an adjacent network to bypass inter-server authentication. Consequently, the attacker can operate with the privileges of a trusted connection, leading to a high impact on data integrity."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid enabling the `no_auth_user` configuration in NATS Server. If `no_auth_user` is required, restrict network access to NATS route and leafnode listeners using firewall rules to only trusted hosts and networks. This limits the attack surface by preventing unauthenticated access from adjacent networks. A restart of the NATS server may be required for configuration changes to take effect."}, "name": "CVE-2026-58253", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.14", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-08T19:43:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58253\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58253\nhttps://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6\nhttps://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6\nhttps://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3\nhttps://github.com/nats-io/nats-server/releases/tag/v2.11.16\nhttps://github.com/nats-io/nats-server/releases/tag/v2.12.7\nhttps://github.com/nats-io/nats-server/releases/tag/v2.14.0\nhttps://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45"], "statement": "This Important flaw in NATS Server permits an unauthenticated attacker on an adjacent network to bypass inter-server authentication when the `no_auth_user` configuration is active. This allows the attacker to operate with trusted connection privileges, leading to a high impact on data integrity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0-preview.1,2.12.6)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "nats-server", "source": "cna", "vendor": "nats-io"}, "product": "nats_server", "vendor": "nats"}], "created": "2026-07-09T09:30:04.681979+00:00", "updated": "2026-07-25T20:45:02.537729+00:00", "vendors": ["nats", "nats$PRODUCT$nats_server"]}