CVE-2026-58211 NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
Attackers can bypass user connection restrictions by exploiting a parser path when the first operation is not CONNECT, requiring no_auth_user configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58211?
CVE-2026-58211 is a medium-severity authentication bypass vulnerability in nats-io nats-server, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply. This issue is fixed in versions 2.14.3 and 2.12.12.
Weakness: CWE-863
Which versions are affected by CVE-2026-58211?
It affects 1 product.
Products include Linuxfoundation Nats-Server.
How do I fix CVE-2026-58211?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-58211 being exploited?
There is no known exploitation of CVE-2026-58211 in the wild and no public exploit code.
Other vulnerabilities in nats-io nats-server
- CVE-2022-28357 NATS nats-server allows directory traversal via unintended path to a management action
- CVE-2026-58253 NATS Server: Route API Auth Bypass
- CVE-2022-24450 Incorrect Authorization in NATS nats-server
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
Sources
Also known as DEBIAN-CVE-2026-58211, GHSA-hmmp-q8cx-v964, UBUNTU-CVE-2026-58211.