Is CVE-2026-58209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58209 being exploited in the wild.

How severe is CVE-2026-58209?

Medium severity, with a CVSS score of 4.3, published 8 July 2026.

Which products and versions are affected?

nats-io NATS Server = 2.14.0-RC.1, < 2.14.3.

Is there a fix for CVE-2026-58209?

A patch was published on 2026-06-29: Versions 2.12.12 and 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58209 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58209?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58209: NATS Server MQTT authorization bypass in subscribe deny rules

Q: Is there a fix for CVE-2026-58209?

A patch was published on 2026-06-29: Versions 2.12.12 and 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58209 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58209?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58209 · Severity: medium · CVSS 4.3 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A security flaw in its MQTT implementation could allow a user to receive messages from topics they are specifically restricted from accessing. This occurs when messages are delivered via 'retained' message or 'durable replay' features, potentially leading to the unauthorized exposure of sensitive data.

Quick answers

Is CVE-2026-58209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58209 being exploited in the wild.
How severe is CVE-2026-58209?: Medium severity, with a CVSS score of 4.3, published 8 July 2026.
Which products and versions are affected?: nats-io NATS Server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3.
Is there a fix for CVE-2026-58209?: A patch was published on 2026-06-29: Versions 2.12.12 and 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58209 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58209?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in NATS Server's MQTT protocol handler. The delivery paths for MQTT retained messages and QoS1+ durable replays do not consistently re-verify the concrete original topic against a subscriber's configured 'subscribe deny' rules before transmission. An authenticated attacker with basic subscriber privileges can exploit this to receive messages on restricted topics if those messages are delivered through these specific replay mechanisms. The issue is resolved in versions 2.12.12 and 2.14.3 by ensuring the original topic is rechecked before an MQTT PUBLISH packet is sent.

Affected products

nats-io NATS Server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

Timeline

2026-06-29: patched: Versions 2.12.12 and 2.14.3 released
2026-07-08: advisory: CVE-2026-58209 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.