Listen to this Post
CVE-2026-58254 exposes a permission bypass in NATS Server, a high‑performance cloud and edge native messaging system. The flaw stems from inconsistent enforcement of message trace destination checks when traffic arrives via leafnode connections. Ordinarily, NATS Server applies strict subject‑based authorization to clients that send trace messages using the `Nats-Trace-Dest` header. This ensures that trace events can only be delivered to subjects the client is explicitly permitted to publish to, and that trace‑only semantics do not interfere with normal message flow. However, prior to versions 2.14.3 and 2.12.8, the authorization logic was not uniformly applied to messages that entered the server through a leafnode – a special connection used to link two NATS servers together in a hierarchical topology.
A leafnode operator (or an attacker who compromises a leafnode) can therefore craft trace‑enabled messages that target arbitrary subjects, including those that would be forbidden for a regular client. Because the server treats these messages as trace‑only, it may also suppress the normal delivery or persistence of the original payload, effectively allowing the attacker to selectively block or redirect messages across the mesh. This bypass is particularly dangerous in multi‑tenant deployments where leafnodes are used to aggregate traffic from different trust domains, as it undermines the isolation provided by subject‑level access controls.
The vulnerability is a remnant of an incomplete fix for an earlier issue (CVE‑2026‑33249) and affects all NATS Server releases before the patched versions. The attack requires the adversary to have leafnode connectivity – a privilege that is often granted to trusted peer servers – but does not demand any special authentication beyond that. Once exploited, the attacker can inject trace events into restricted subjects, disrupt the delivery of legitimate messages, and potentially gather information about message flows by observing trace responses. The CVSS base score is 5.3 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting the network‑accessible nature, low complexity, and limited but tangible impact on confidentiality, integrity, and availability.
The issue was responsibly disclosed and fixed in the 2.14.3 and 2.12.8 releases. Administrators are strongly advised to upgrade immediately. If an immediate upgrade is not possible, disabling leafnode support or restricting leafnode listener access to trusted IP ranges can serve as a temporary mitigation.
DailyCVE Form:
Platform: NATS Server
Version: < 2.14.3, < 2.12.8
Vulnerability: Incorrect Authorization (CWE‑863)
Severity: Medium (CVSS 5.3)
Date: 2026‑07‑08
Prediction: Patches available in 2.14.3/2.12.8
What Undercode Say:
Analytics
- EPSS probability: 0.43% (35th percentile) – low likelihood of active exploitation in the wild.
- Affected package:
github.com/nats-io/nats-server/server. - All versions before 2.14.0‑RC.1 and up to 2.14.2 are vulnerable.
- The flaw is a direct consequence of an incomplete patch for CVE‑2026‑33249.
Bash Commands & Code Snippets
Check current NATS Server version
nats-server -version
Verify if leafnode is enabled (look for 'leafnode' in configuration)
grep -i "leafnode" /etc/nats-server.conf
Example leafnode configuration (vulnerable)
leafnode {
listen: "0.0.0.0:7422"
authorization: {
user: "leaf_user"
password: "leaf_pass"
}
}
Upgrade to patched version using Go modules
go get github.com/nats-io/nats-server/[email protected]
Or using Docker
docker pull nats:2.14.3-alpine
Exploit:
An attacker with leafnode access crafts a message with the `Nats-Trace-Dest` header set to a restricted subject (e.g., $SYS.REQ.ADMIN). The server fails to validate this destination against the leafnode’s permissions, allowing the trace event to be published. Concurrently, the attacker can set trace‑only flags to prevent the original message from being delivered to its intended consumers, effectively mounting a denial‑of‑service or data exfiltration attack on sensitive subjects.
Protection:
- Upgrade to NATS Server 2.14.3 or 2.12.8 immediately.
- If upgrading is not feasible, disable leafnode support entirely (
leafnode { }block removed). - Restrict leafnode listener access using firewall rules to only trusted peer IPs.
- Enable audit logging to monitor for unexpected trace‑header usage on leafnode connections.
Impact:
- Confidentiality: An attacker can send trace events to subjects they are not authorized to access, potentially revealing message metadata.
- Integrity: Trace‑only behavior can cause legitimate messages to be dropped or misrouted, corrupting application state.
- Availability: By flooding restricted subjects with trace events, an attacker can degrade performance or block critical messages, leading to service disruption.
- Compliance: Multi‑tenant environments may face regulatory breaches if isolation between tenants is broken.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
