Is CVE-2026-58254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58254 being exploited in the wild.

How severe is CVE-2026-58254?

Informational severity, with a CVSS score of 5.3, published 8 July 2026.

Which products and versions are affected?

nats-io nats-server = 2.14.0-RC.1, < 2.14.3.

Is there a fix for CVE-2026-58254?

A patch was published on 2026-06-29: Version 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58254 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58254?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58254: NATS Server authorization bypass in leafnode message tracing

Q: Is there a fix for CVE-2026-58254?

A patch was published on 2026-06-29: Version 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58254 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58254?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58254 · Severity: info · CVSS 5.3 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in how the server handles message tracing allows operators of connected 'leaf nodes' to bypass security checks. This could allow an attacker to redirect sensitive trace data (containing routing and account metadata) to unauthorized locations or interfere with the normal delivery and storage of messages.

Quick answers

Is CVE-2026-58254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58254 being exploited in the wild.
How severe is CVE-2026-58254?: Informational severity, with a CVSS score of 5.3, published 8 July 2026.
Which products and versions are affected?: nats-io nats-server < 2.12.8, >= 2.14.0-RC.1, < 2.14.3.
Is there a fix for CVE-2026-58254?: A patch was published on 2026-06-29: Version 2.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58254 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58254?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in NATS Server due to inconsistent application of message trace destination checks. While ordinary client connections are properly restricted, messages arriving via leafnode connections do not consistently undergo the same 'Nats-Trace-Dest' header validation. A leafnode operator can exploit this to send trace events—which may contain routing, subscription, and JetStream metadata—to unauthorized subjects. Additionally, an attacker can use trace-only behavior to prevent the normal delivery or storage of messages. The issue is addressed in versions 2.14.3 and 2.12.8.

Affected products

nats-io nats-server < 2.12.8, >= 2.14.0-RC.1, < 2.14.3

Timeline

2026-06-29: advisory: GitHub Security Advisory GHSA-p3j5-5hrq-p75h published
2026-06-29: patched: Version 2.14.3 released
2026-04-27: patched: Version 2.12.8 released
2026-07-08: disclosed: CVE-2026-58254 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.