Is CVE-2026-58214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58214 being exploited in the wild.

How severe is CVE-2026-58214?

Medium severity, with a CVSS score of 4.3, published 8 July 2026.

Which products and versions are affected?

nats-io nats-server = 2.14.0-RC.1, < 2.14.3.

Is there a fix for CVE-2026-58214?

A patch was published on 2026-06-29: Versions 2.12.12 and 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58214 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58214?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58214: NATS Server MQTT authorization bypass in internal subject subscription

Q: Is there a fix for CVE-2026-58214?

A patch was published on 2026-06-29: Versions 2.12.12 and 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58214 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58214?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58214 · Severity: medium · CVSS 4.3 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A security flaw allowed authenticated users to bypass their assigned permissions and access internal message metadata. This could lead to the exposure of sensitive protocol information belonging to other sessions within the same account.

Quick answers

Is CVE-2026-58214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58214 being exploited in the wild.
How severe is CVE-2026-58214?: Medium severity, with a CVSS score of 4.3, published 8 July 2026.
Which products and versions are affected?: nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3.
Is there a fix for CVE-2026-58214?: A patch was published on 2026-06-29: Versions 2.12.12 and 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58214 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58214?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in NATS Server's MQTT implementation. Authenticated MQTT clients can subscribe to the internal '$MQTT.deliver.pubrel' subject family, which should be restricted. This bypasses configured subscription ACLs and allows an attacker to view MQTT Quality of Service 2 (QoS2) protocol metadata for other sessions within the same account. The issue stems from a failure to block subscriptions to this specific internal prefix in the 'processSubs' function within 'server/mqtt.go'. The vulnerability is fixed in versions 2.12.12 and 2.14.3 by explicitly rejecting subscription requests for the affected internal subject prefix.

Affected products

nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

Timeline

2026-06-29: patched: Versions 2.12.12 and 2.14.3 released
2026-07-08: disclosed: CVE-2026-58214 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.