Back to overview

CVE-2026-58209

MEDIUM
4.3
CVSS 3.1
Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

Metadata

CVE ID
CVE-2026-58209
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-29 17:09 UTC
Published
2026-07-08 20:12 UTC
Last updated
2026-07-09 13:31 UTC
Primary CWE
CWE-863
CWE-863: Incorrect Authorization
Vendor / Product
nats-io / nats-server
Sources
cve.org  ·  NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
nats-io nats-server — < 2.12.12, >= 2.14.0-RC.1, < 2.14.3
Weakness (CWE)
CWESourceDescription
CWE-863 cna CWE-863: Incorrect Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References (5)
Back to overview