Executive brief
NATS Server is a messaging system used to connect cloud and edge applications. A security flaw allows unauthorized users to bypass authentication when the server is configured to allow certain guest access. This could allow an attacker to impersonate a trusted server or node, potentially leading to unauthorized data access or disruption of the messaging network.
Technical details
An authentication bypass vulnerability exists in NATS Server when the 'no_auth_user' option is enabled. A parser 'fast path' optimization, originally intended only for standard client connections, was incorrectly applied to route and leafnode listeners. An unauthenticated attacker on an adjacent network can exploit this to bypass inter-server CONNECT authentication. Successful exploitation allows the attacker to operate with the elevated privileges associated with server-to-server or leafnode connection types. The issue is addressed in versions 2.14.0, 2.12.7, and 2.11.16 by restricting the 'no_auth_user' logic to client connections only.
Affected products
- NATS.io NATS Server < 2.11.16, >= 2.12.0-preview.1, < 2.12.7, < 2.14.0
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched
References
- https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6
- https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6
- https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3
- https://github.com/nats-io/nats-server/releases/tag/v2.11.16
- https://github.com/nats-io/nats-server/releases/tag/v2.12.7
- https://github.com/nats-io/nats-server/releases/tag/v2.14.0
- https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45