Executive brief
NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in how the server handles message tracing allows operators of connected 'leaf nodes' to bypass security checks. This could allow an attacker to redirect sensitive trace data (containing routing and account metadata) to unauthorized locations or interfere with the normal delivery and storage of messages.
Technical details
An authorization bypass exists in NATS Server due to inconsistent application of message trace destination checks. While ordinary client connections are properly restricted, messages arriving via leafnode connections do not consistently undergo the same 'Nats-Trace-Dest' header validation. A leafnode operator can exploit this to send trace events—which may contain routing, subscription, and JetStream metadata—to unauthorized subjects. Additionally, an attacker can use trace-only behavior to prevent the normal delivery or storage of messages. The issue is addressed in versions 2.14.3 and 2.12.8.
Affected products
- nats-io nats-server < 2.12.8, >= 2.14.0-RC.1, < 2.14.3
Timeline
- 2026-06-29: advisory: GitHub Security Advisory GHSA-p3j5-5hrq-p75h published
- 2026-06-29: patched: Version 2.14.3 released
- 2026-04-27: patched: Version 2.12.8 released
- 2026-07-08: disclosed: CVE-2026-58254 published to NVD