Skip to content
OpenAdvisories
High WID-SEC-2026-2132 12 CVEs

NATS Server: Mehrere Schwachstellen

Published Jun 29, 2026 · Updated Jul 14, 2026 · Revision 3 · de-DE

Vendor: Microsoft Product: Azure Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Der NATS-Server ist ein Server für NATS.io, das Cloud- und Edge-native Messaging-System.

Vulnerabilities 12

  • High 8.8
    CVE-2026-58253

    NATS Server: Route API Auth Bypass

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or …

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • High 7.7
    CVE-2026-58207

    NATS Server: Remote crash via integer overflow in Connz pagination

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and …

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-58210

    NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication complete…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • High 7.5
    CVE-2026-58250

    NATS Server: Pre-auth server crash via double INFO in leafnode handshake

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-au…

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-58213

    NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to r…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • Medium 6.8
    CVE-2026-58208

    NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, all…

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-58251

    NATS Server: Queue Subscribe Authz Bypass

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscripti…

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-58252

    NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured w…

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • Medium 5.4
    CVE-2026-58211

    NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNE…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • Medium 5.3
    CVE-2026-58254

    NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafno…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • Medium 4.3
    CVE-2026-58209

    NATS Server: MQTT retained and QoS replay bypass subscribe deny filters

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured…

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • Medium 4.3
    CVE-2026-58214

    NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe per…

    nats-io nats-server nats-server nats-server Debian Ubuntu

Revision history

  1. #3

    Neue Updates aufgenommen

  2. #2

    CVE-Nummern ergänzt

  3. #1

    Initiale Fassung

References