Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-58252

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset of it, and queue subscriptions could also affect delivery to legitimate queue consumers. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:71fa8fb899834beaa8ca649d4e1665832286a932d026f930ed9451fa417a85e0
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"nats-server","vendor":"nats-io","versions":[{"status":"affected","version":"< 2.11.16"},{"status":"affected","version":">= 2.12.0-preview.1, < 2.12.7"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-285","description":"CWE-285: Improper Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/problemTypes/0/descriptions/0

Source references

7 source assertions
{"name":"https://github.com/nats-io/nats-server/commit/8ced85a11497f86704a95d960281480ce037386b","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/commit/8ced85a11497f86704a95d960281480ce037386b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/1
{"name":"https://github.com/nats-io/nats-server/commit/a42a6d1e258eb5c3a2190384d31965a4b715e854","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/commit/a42a6d1e258eb5c3a2190384d31965a4b715e854"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/2
{"name":"https://github.com/nats-io/nats-server/commit/e611ca9604697b02d8f22beb76037400a9cf72e6","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/commit/e611ca9604697b02d8f22beb76037400a9cf72e6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/3
{"name":"https://github.com/nats-io/nats-server/releases/tag/v2.11.16","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/releases/tag/v2.11.16"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/4
{"name":"https://github.com/nats-io/nats-server/releases/tag/v2.12.7","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/releases/tag/v2.12.7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/5
{"name":"https://github.com/nats-io/nats-server/releases/tag/v2.14.0","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/releases/tag/v2.14.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/6
{"name":"https://github.com/nats-io/nats-server/security/advisories/GHSA-wh7g-5m82-pmhr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nats-io/nats-server/security/advisories/GHSA-wh7g-5m82-pmhr"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:83a8e793c32af779a8c438db51b6b089d1d75a347c17b97cb5ce8620c3c0dc34 · sha256:f7928a57f317db65… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer