PT-2026-56562 · Nats.Io · Nats Server

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-58214

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-58214

Affected Products

Nats Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-58214 · Security Note
• https://github.com/nats-io/nats-server/commit/34b09657bb596d5f850eaa5cfc97ea6b2f989a97 · Note
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 · Note
• https://github.com/nats-io/nats-server/commit/297b166be60fe13144084eed4b25201ead03204a · Note
• https://github.com/nats-io/nats-server/security/advisories/GHSA-4g68-3pwx-5vfj · Note
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 · Note