CVE-2026-58252CWE-285

NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

Medium · published July 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset of it, and queue subscriptions could also affect delivery to legitimate queue consumers. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00464 · 39.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-07-08T19:46Z
EPSS history
Timeline
  • 08 JUL 19:46Z
    NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
    cvelistv5