Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.9
CVE-2026-58254: NATS Server leaf nodes can bypass message trace restrictions
CVE-2026-58254 · published 3 months ago
Summary
If you run NATS Server versions older than 2.14.3 (or 2.12.8), a linked server can send trace messages to places it shouldn’t reach and prevent those messages from being delivered normally. This could allow an attacker to view or hide information that should be protected. Upgrade NATS Server to the latest version that includes the fix.
What to do
- Update debian nats-server to version 2.14.3-1.
- Update nats to version 2.14.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linuxfoundation | nats-server |
>= 2.14.0, < 2.14.3 < 2.12.8 cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* |
| Debian:12 | debian | nats-server | All versions |
| Debian:13 | debian | nats-server | All versions |
| Debian:14 | debian | nats-server |
< 2.14.3-1 Fix: upgrade to 2.14.3-1
|
| Ubuntu:24.04:LTS | canonical | nats-server | All versions |
| Ubuntu:25.10 | canonical | nats-server | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | nats-server | All versions |
| – | nats-io | nats-server | < 2.12.8 |
| Bitnami | – | nats |
>= 2.14.0, < 2.14.3 Fix: upgrade to 2.14.3
|
Original advisory text
NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode operator to send trace events to subjects that would not otherwise be permitted and to use trace-only behavior to prevent normal delivery or storage of affected messages. This issue is fixed in versions 2.14.3 and 2.12.8.
References
- https://security-tracker.debian.org/tracker/CVE-2026-58254 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58254 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-58254 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-58254 Third Party Advisory
- https://github.com/nats-io/nats-server/releases/tag/v2.12.8 URL
- https://github.com/nats-io/nats-server/commit/cbe845932980b71563efac5cfa4cc751c8... Patch
- https://github.com/nats-io/nats-server/releases/tag/v2.14.3 URL
- https://github.com/nats-io/nats-server/security/advisories/GHSA-p3j5-5hrq-p75h Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58254... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.9
High
Type
CWE-863Incorrect Authorization
Timeline
Published8 Jul 2026
Updated31 Oct 2026
First seen6 Jul 2026
Sources
DEBIAN-CVE-2026-58254 · OSV
UBUNTU-CVE-2026-58254 · OSV
CVE-2026-58254 · NVD
CVE-2026-58254 · MITRE
BIT-nats-2026-58254 · OSV
GHSA-p3j5-5hrq-p75h · GHSA
CVE-2026-58254 · OSV
Track software like this
Free during beta