CVE-2026-58252: NATS Server authorization bypass via overlapping wildcard subscriptions

CVE-2026-58252 · Severity: medium · CVSS 6.5 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing to route data between different applications. A security flaw in how the server handles access control rules allowed authenticated users to bypass restrictions and receive messages they were supposed to be blocked from seeing. This could lead to the unauthorized exposure of sensitive data transmitted across the messaging network.

Quick answers

Is CVE-2026-58252 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58252 being exploited in the wild.
How severe is CVE-2026-58252?
Medium severity, with a CVSS score of 6.5, published 8 July 2026.
Which products and versions are affected?
nats-io nats-server < 2.11.16, >= 2.12.0-preview.1 < 2.12.7, < 2.14.0.
Is there a fix for CVE-2026-58252?
A patch was published on 2026-04-14: Initial patches for 2.11 and 2.12 branches released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58252 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58252?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass vulnerability exists in NATS Server's ACL enforcement mechanism. The root cause is the use of `subjectIsSubsetMatch` in the `client.canSubscribe` method, which failed to account for overlapping wildcard patterns that were not strict subsets (e.g., a subscription to 'foo.*' could receive messages from a denied subject like '*.secret'). An authenticated attacker can exploit this by crafting specific wildcard subscriptions to intercept messages on subjects they are explicitly denied access to. Additionally, queue subscriptions could interfere with delivery to legitimate consumers. The fix replaces the vulnerable logic with `SubjectsCollide` to properly detect intersections between wildcard subjects. Patches are available in versions 2.11.16, 2.12.7, and 2.14.0.

Affected products

  • nats-io nats-server < 2.11.16, >= 2.12.0-preview.1 < 2.12.7, < 2.14.0

Timeline

  • 2026-07-08: disclosed
  • 2026-07-08: advisory
  • 2026-04-14: patched: Initial patches for 2.11 and 2.12 branches released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.