What’s Vulnerable › Vulnerabilities

CVE-2026-58214: NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-863

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.

Affected products

• nats-io nats-server: before 2.12.12; from 2.14.0 before 2.14.3 — fixed in 2.12.12, 2.14.3

How to fix

Upgrade to a fixed version: nats-io nats-server 2.12.12, 2.14.3. Check the vendor advisory for mitigations.

References

• https://github.com/nats-io/nats-server/commit/297b166be60fe13144084eed4b25201ead03204a
• https://github.com/nats-io/nats-server/commit/34b09657bb596d5f850eaa5cfc97ea6b2f989a97
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3
• https://github.com/nats-io/nats-server/security/advisories/GHSA-4g68-3pwx-5vfj

Get alerted when CVE-2026-58214 or the next vulnerability affects your stack