CVE-2026-58252: NATS Server authorization bypass via overlapping wildcard subscriptions

CVE-2026-58252 · Severity: medium · CVSS 6.5 · Published 2026-07-08

Executive brief

NATS Server is a high-performance messaging system used for cloud and edge computing to route data between different applications. A security flaw in how the server handles access control rules allowed authenticated users to bypass restrictions and receive messages they were supposed to be blocked from seeing. This could lead to the unauthorized exposure of sensitive data transmitted across the messaging network.

Technical details

An authorization bypass vulnerability exists in NATS Server's ACL enforcement mechanism. The root cause is the use of `subjectIsSubsetMatch` in the `client.canSubscribe` method, which failed to account for overlapping wildcard patterns that were not strict subsets (e.g., a subscription to 'foo.*' could receive messages from a denied subject like '*.secret'). An authenticated attacker can exploit this by crafting specific wildcard subscriptions to intercept messages on subjects they are explicitly denied access to. Additionally, queue subscriptions could interfere with delivery to legitimate consumers. The fix replaces the vulnerable logic with `SubjectsCollide` to properly detect intersections between wildcard subjects. Patches are available in versions 2.11.16, 2.12.7, and 2.14.0.

CVE-2026-58252: NATS Server authorization bypass via overlapping wildcard subscriptions

Executive brief

Technical details

Affected products

Timeline

References