CVE-2026-58253 NATS Server: Route API Auth Bypass
An unauthenticated peer can bypass inter-server authentication when no_auth_user is configured, gaining route or leafnode privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58253?
CVE-2026-58253 is a high-severity authentication bypass vulnerability in nats-io nats-server, published on 8 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Weakness: CWE-287
Which versions are affected by CVE-2026-58253?
1 open source package ship an affected version, including nats. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nats Bitnami | All versions | 2.11.16, 2.12.6 |
Products include Linuxfoundation Nats-Server.
How do I fix CVE-2026-58253?
Upgrade nats to a fixed version for your release line: 2.11.16 or 2.12.6.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-58253 being exploited?
There is no known exploitation of CVE-2026-58253 in the wild and no public exploit code.
Other vulnerabilities in nats-io nats-server
- CVE-2022-28357 NATS nats-server allows directory traversal via unintended path to a management action
- CVE-2022-24450 Incorrect Authorization in NATS nats-server
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
- CVE-2026-58210 NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
Sources
Also known as AZL-92259, BIT-nats-2026-58253, DEBIAN-CVE-2026-58253, GHSA-38x3-76xf-cq45, JLSEC-2026-1153, MINI-587x-32wf-hqhx and 2 more.