# CVE-2026-58251: NATS Server authorization bypass via queue subscriptions

Source: https://junglewise.ai/threats/cve-2026-58251-nats-server-authorization-bypass-via-queue-subscriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-58251 · Severity: medium · CVSS 6.5 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A security flaw allowed authenticated users to bypass access controls and subscribe to restricted data channels by using a specific 'queue subscription' method. This could lead to unauthorized access to sensitive information that the user was explicitly forbidden from viewing.

## Quick answers

**Is CVE-2026-58251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58251 being exploited in the wild.

**How severe is CVE-2026-58251?** Medium severity, with a CVSS score of 6.5, published 8 July 2026.

**Which products and versions are affected?** nats-io NATS Server < 2.11.16, >= 2.12.0-RC.1 < 2.12.7, < 2.14.0.

**Is there a fix for CVE-2026-58251?** A patch was published on 2026-04-14: Fixes included in v2.11.16 and v2.12.7 releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58251 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58251?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-285) exists in NATS Server's ACL evaluation logic. When a user creates a queue subscription, the server's check for queue-specific deny rules could incorrectly override a previously matched 'deny' rule for the plain subject. Specifically, if a subject was denied but the queue name itself was not explicitly denied, the subscription was permitted. This allows an authenticated attacker with network access to bypass 'subscribe deny' permissions. The issue is resolved in versions 2.11.16, 2.12.7, and 2.14.0 by ensuring queue-specific checks do not overwrite existing subject-based denials.

## Affected products

- nats-io NATS Server < 2.11.16, >= 2.12.0-RC.1 < 2.12.7, < 2.14.0

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-04-14: patched: Fixes included in v2.11.16 and v2.12.7 releases

## References

- [https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c](https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c)
- [https://github.com/nats-io/nats-server/commit/79c2f6e9ff87f594596337b6427dda85c38d1fe1](https://github.com/nats-io/nats-server/commit/79c2f6e9ff87f594596337b6427dda85c38d1fe1)
- [https://github.com/nats-io/nats-server/commit/b9ffb63b85e7db3d25a13b2e234f5f7f7c13164d](https://github.com/nats-io/nats-server/commit/b9ffb63b85e7db3d25a13b2e234f5f7f7c13164d)
- [https://github.com/nats-io/nats-server/releases/tag/v2.11.16](https://github.com/nats-io/nats-server/releases/tag/v2.11.16)
- [https://github.com/nats-io/nats-server/releases/tag/v2.12.7](https://github.com/nats-io/nats-server/releases/tag/v2.12.7)
- [https://github.com/nats-io/nats-server/releases/tag/v2.14.0](https://github.com/nats-io/nats-server/releases/tag/v2.14.0)
- [https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322](https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322)