TI-2026-41921 Aliases CVE-2026-58211

NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions

LOW 24CWE-863Published 2026-07-08 · Updated 2026-07-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply. This issue is fixed in versions 2.14.3 and 2.12.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-07

Fix Fixed nats-server (nats-io): 2.12.12, 2.14.3Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	nats-server	before 2.12.12; 2.14.0-RC.1 to before 2.14.3	2.12.12, 2.14.3	Patch available	CNA

nats-server Vendorbackstage Affected before 2.12.12; 2.14.0-RC.1 to before 2.14.3 Fixed in 2.12.12, 2.14.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:nats-server::::::::	2.12.0 to before 2.12.12; 2.14.0 to before 2.14.3	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* Versions 2.12.0 to before 2.12.12; 2.14.0 to before 2.14.3 Vulnerable ·backstage

Remediation

Fix · CNA nats-server (nats-io) Fixed in 2.12.12, 2.14.3

Red Hat 2 advisories

RHSA-2026:36017 Released 2026-07-06 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nats-server2-12-main@aarch64, nats-server2-12-main@src, nats-server2-12-main@x86_64
RHSA-2026:36016 Released 2026-07-06 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nats-server2-14-main@aarch64, nats-server2-14-main@src, nats-server2-14-main@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Fixed	RHSA-2026:36016, RHSA-2026:36017

Timeline

2026-10-02 Threatist record created from CVE-2026-58211

References

Advisory 1

https://github.com/nats-io/nats-server/security/advisories/GHSA-hmmp-q8cx-v964

TI-2026-22233 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVSS 3.1HIGH 7.5
TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences