Executive brief
NATS Server is a high-performance messaging system used for cloud and edge computing. A security flaw allows certain users to bypass connection restrictions, such as requirements to use a specific proxy or connection type. This could allow an unauthorized user to gain the permissions of a default 'no-authentication' user, potentially leading to unauthorized data access or message manipulation depending on that user's configuration.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in NATS Server's parser logic. When a client's first operation is not a 'CONNECT' command, the server utilizes a specific parser path that registers the client as the configured 'no_auth_user' without enforcing standard connection restrictions like 'allowed_connection_types' or 'proxy_required'. An attacker with network access can exploit this to assume the identity and permissions of the default unauthenticated user while bypassing security boundaries intended to restrict that user to specific network paths or proxies. The issue is resolved in versions 2.14.3 and 2.12.12.
Affected products
- nats-io NATS Server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3
Timeline
- 2026-06-29: advisory: GitHub advisory published by maintainers
- 2026-07-08: disclosed: CVE published to NVD