CVE-2026-58211: NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured noauthuser through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowedconnectiontypes or proxyrequired that normal authentication would apply. This issue is fixed in versions 2.14.3 and 2.12.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NATS Serverto a version that resolves this vulnerability.Fixed in 2.14.3 - Upgrade
Upgrade
NATS Serverto a version that resolves this vulnerability.Fixed in 2.12.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58211?
The severity of CVE-2026-58211 is rated medium with a score of 5.4.
How do I fix CVE-2026-58211?
To fix CVE-2026-58211, upgrade to NATS Server versions 2.14.3 or 2.12.12 or newer.
What are the potential impacts of CVE-2026-58211?
CVE-2026-58211 can potentially allow unauthorized users to bypass connection restrictions due to a flaw in client registration.
Who is affected by CVE-2026-58211?
CVE-2026-58211 affects users of NATS Server versions prior to 2.14.3 and 2.12.12.
What is the root cause of CVE-2026-58211?
The root cause of CVE-2026-58211 is a bypass in the parser path when a client's first operation is not a CONNECT.