CVE-2026-58253
NATS Server: Route API Auth Bypass
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
NATS Server: Route API Auth Bypass
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
CVE-2026-58253- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-42375
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
EUVD-2026-42375- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
NVD
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
CVE-2026-58253- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
NATS Server: Route API Auth Bypass
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
CVE-2026-58253- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-58253
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
DEBIAN-CVE-2026-58253- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVJLSEC-2026-1153
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
JLSEC-2026-1153- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-58253
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
UBUNTU-CVE-2026-58253- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVAZL-92259 No score
CVE-2026-58253 affecting package telegraf for versions less than 1.31.0-27
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
AZL-92259- Updated
- 2026-11-05
OSVBIT-nats-2026-58253 No score
NATS Server: Route API Auth Bypass
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
- Record
BIT-nats-2026-58253- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
telegrafAzure Linux:3 |
before 1.31.0-27 | 1.31.0-27 |
natsBitnami |
before 2.11.16, 2.12.0 up to 2.12.6 | 2.11.162.12.6 |
nats-serverDebian:12 |
All versions, plus listed versions 2.10.1-12.10.16-12.10.18-12.10.24-12.10.27-1 Show 11 moreShow less2.10.3-12.10.4-12.10.7-12.12.4-12.12.6-12.14.1-12.14.3-12.14.6-12.15.1-12.9.10-12.9.19-1 |
None known |
nats-serverDebian:13 |
All versions, plus listed versions 2.10.27-12.12.4-12.12.6-12.14.1-12.14.3-12.14.6-12.15.1-1 |
None known |
nats-serverDebian:14 |
before 2.14.1-1, plus listed versions 2.10.27-12.12.4-12.12.6-1 |
2.14.1-1 |
nats_server_jllJulia |
before 2.14.3+0 | 2.14.3+0 |
nats-serverUbuntu:24.04:LTS |
All versions, plus listed versions 2.9.19-1build12.10.3-12.10.4-12.10.7-12.10.7-1ubuntu0.12.10.7-1ubuntu0.22.10.7-1ubuntu0.3 |
None known |
nats-serverUbuntu:25.10 |
All versions, plus listed versions 2.10.24-12.10.27-1 |
None known |
nats-serverUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.10.27-12.10.27-1build12.10.27-1ubuntu0.26.04.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58253 is a high vulnerability (CVSS 8.8) in Linuxfoundation Nats-server, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in telegraf 1.31.0-27.
References
github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45