CVE-2026-58209
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
CVE-2026-58209- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-42347
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
EUVD-2026-42347- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
NVD
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
CVE-2026-58209- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
CVE-2026-58209- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-58209
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
DEBIAN-CVE-2026-58209- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-1146
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
JLSEC-2026-1146- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2026:36016
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:36016- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:36017
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:36017- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-58209
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
UBUNTU-CVE-2026-58209- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-92256 No score
CVE-2026-58209 affecting package telegraf for versions less than 1.31.0-27
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
AZL-92256- Updated
- 2026-11-05
OSVBIT-nats-2026-58209 No score
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
- Record
BIT-nats-2026-58209- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
telegrafAzure Linux:3 |
before 1.31.0-27 | 1.31.0-27 |
natsBitnami |
before 2.12.12, 2.14.0 up to 2.14.3 | 2.12.122.14.3 |
nats-serverDebian:12 |
All versions, plus listed versions 2.10.1-12.10.16-12.10.18-12.10.24-12.10.27-1 Show 11 moreShow less2.10.3-12.10.4-12.10.7-12.12.4-12.12.6-12.14.1-12.14.3-12.14.6-12.15.1-12.9.10-12.9.19-1 |
None known |
nats-serverDebian:13 |
All versions, plus listed versions 2.10.27-12.12.4-12.12.6-12.14.1-12.14.3-12.14.6-12.15.1-1 |
None known |
nats-serverDebian:14 |
before 2.14.3-1, plus listed versions 2.10.27-12.12.4-12.12.6-12.14.1-1 |
2.14.3-1 |
nats_server_jllJulia |
before 2.14.3+0 | 2.14.3+0 |
nats-server2.14Red Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:2.14.3-1.hum1 | 0:2.14.3-1.hum1 |
nats-server2.12Red Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:2.12.12-1.hum1 | 0:2.12.12-1.hum1 |
nats-serverUbuntu:24.04:LTS |
All versions, plus listed versions 2.9.19-1build12.10.3-12.10.4-12.10.7-12.10.7-1ubuntu0.12.10.7-1ubuntu0.22.10.7-1ubuntu0.3 |
None known |
nats-serverUbuntu:25.10 |
All versions, plus listed versions 2.10.24-12.10.27-1 |
None known |
nats-serverUbuntu:26.10 |
All versions, plus listed versions 2.10.27-1build12.14.1-12.14.3-1 |
None known |
nats-serverUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.10.27-12.10.27-1build12.10.27-1ubuntu0.26.04.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58209 is a medium vulnerability (CVSS 4.3) in Linuxfoundation Nats-server, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in telegraf 1.31.0-27.
References
github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg
nvd.nist.gov/vuln/detail/CVE-2026-58209
Show 50 moreShow less
security-tracker.debian.org/tracker/CVE-2026-58209
access.redhat.com/errata/RHSA-2026:36016
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36016.json
bugzilla.redhat.com/show_bug.cgi?id=2498259
cve.org/CVERecord?id=CVE-2026-58209
ubuntu.com/security/CVE-2026-58209