NATS Server MQTT Topic Bypass: Deny Rules Not Enforced (v<2.12.12, v<2.14.3)
CVE-2026-58209 Published on July 8, 2026
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
Vulnerability Analysis
CVE-2026-58209 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-58209 has been classified to as an AuthZ vulnerability or weakness.
Affected Versions
nats-io nats-server:- Version < 2.12.12 is affected.
- Version >= 2.14.0-RC.1, < 2.14.3 is affected.