PT-2026-56583 · Unknown · Nats Server
CVE-2026-58211
·
Published
2026-07-08
·
Updated
2026-07-09
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
NATS Server versions prior to 2.14.3
NATS Server versions prior to 2.12.12
Description
A flaw exists where a client can be registered as the configured
no auth user via a parser path triggered when the initial client operation is not CONNECT. This allows the client to bypass user-level connection restrictions that standard authentication would normally enforce, such as allowed connection types or proxy required.Recommendations
Update NATS Server to version 2.14.3 or later.
Update NATS Server to version 2.12.12 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nats Server