CVE-2026-58211

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58211
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58211.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58211
Aliases
  • GHSA-hmmp-q8cx-v964
Downstream
Published
2026-07-08T20:16:25.262Z
Modified
2026-08-12T03:51:28.386378529Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
Details

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured noauthuser through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowedconnectiontypes or proxy_required that normal authentication would apply. This issue is fixed in versions 2.14.3 and 2.12.12.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58211.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nats-io/nats-server

Affected ranges

Type
GIT
Repo
https://github.com/nats-io/nats-server
Events
Introduced
fc6ec648d806652d282d2f0edb6cb9f22c895572
Fixed
e8de2a67c7a094abca6013931ecf6cbff4b3fb02
Introduced
0cbd01caf8f29011c26273ff7662addd3830396a
Fixed
9b17a586be69c9ff36e4c84a421ca47da410b561
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.12.0"
        },
        {
            "fixed": "2.12.12"
        },
        {
            "introduced": "2.14.0"
        },
        {
            "fixed": "2.14.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v2.*
v2.12.0
v2.12.1
v2.12.1-RC.1
v2.12.1-RC.2
v2.12.1-RC.3
v2.12.1-RC.4
v2.12.1-RC.5
v2.12.10
v2.12.10-RC.1
v2.12.11
v2.12.2
v2.12.2-RC.1
v2.12.2-RC.2
v2.12.2-RC.3
v2.12.2-RC.4
v2.12.3
v2.12.3-RC.1
v2.12.3-RC.2
v2.12.3-RC.3
v2.12.3-RC.4
v2.12.3-RC.5
v2.12.4
v2.12.4-RC.1
v2.12.4-RC.2
v2.12.4-RC.3
v2.12.4-RC.4
v2.12.4-RC.5
v2.12.4-RC.6
v2.12.5
v2.12.5-RC.1
v2.12.5-RC.2
v2.12.6
v2.12.7
v2.12.8
v2.12.9
v2.12.9-RC.1
v2.12.9-RC.2
v2.14.0
v2.14.1
v2.14.1-RC.1
v2.14.1-RC.2
v2.14.2
v2.14.2-RC.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58211.json"