CVE-2026-58253: 
NixOS vulnerability analysis and mitigation

CVE-2026-58253 is an authentication bypass vulnerability in NATS Server, the high-performance messaging server for NATS.io, classified as "Route API Auth Bypass." When no_auth_user is configured, a parser fast path intended exclusively for ordinary client connections could also be triggered on route or leafnode listeners, allowing an unauthenticated adjacent-network peer to bypass inter-server CONNECT authentication and operate with the privileges of that connection type. Affected versions are all releases prior to 2.11.16 (2.11.x branch), prior to 2.12.7 (2.12.x branch), and prior to 2.14.0. The vulnerability was disclosed on June 29, 2026 via a GitHub Security Advisory and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-287 (Improper Authentication) and CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization). In server/parser.go, the no_auth_user fast path — which allows non-CONNECT protocol messages as the first command — lacked a check for the connection kind (c.kind), so it applied to ROUTER, LEAF, and GATEWAY connection types in addition to CLIENT connections. An unauthenticated peer with network access to a route or leafnode listener could send a non-CONNECT command (e.g., PING) before the inter-server CONNECT authentication flow completed, bypassing credential verification entirely and gaining the privileges associated with that inter-server connection type. The fix, applied in commits 7b81dd4, 8b8e1ad, and b86147e, adds the condition && c.kind == CLIENT to the fast-path check and explicitly routes ROUTER, LEAF, and unauthenticated GATEWAY connections to an auth error (GitHub Advisory, Patch Commit).

A successful exploit allows an unauthenticated attacker on an adjacent network to join a NATS cluster as a rogue route or leafnode peer, operating with full inter-server privileges. This enables the attacker to read messages flowing through the cluster (low confidentiality impact), inject or modify messages across accounts (high integrity impact), and potentially disrupt message delivery (low availability impact). Because the scope is changed, a compromised route connection can affect resources beyond the directly targeted server node, including other cluster members and their subscribers (GitHub Advisory, Feedly).

1. Reconnaissance: Identify NATS Server instances with route or leafnode listener ports exposed on the adjacent network (default cluster port 6222, leafnode port 7422). Confirm the server version is below 2.11.16, 2.12.7, or 2.14.0 using banner information from the initial INFO message.
2. Verify no_auth_user configuration: Connect to the target route or leafnode listener port via TCP. The server will respond with an INFO JSON message. If no_auth_user is configured on the server, the fast path is active.
3. Send non-CONNECT command: Without sending a CONNECT message (which would require valid route/leaf credentials), immediately send a PING\r\n command to the route or leafnode listener port.
4. Bypass authentication: On vulnerable versions, the parser fast path processes the PING without enforcing the inter-server CONNECT authentication flow, responding with PONG and treating the connection as an authenticated inter-server peer.
5. Operate with inter-server privileges: Once authenticated as a route or leafnode peer, send route-protocol messages (e.g., RMSG $G <subject> <size>\r\n<payload>\r\n) to inject messages across accounts, subscribe to cluster traffic, or manipulate message routing within the NATS cluster (GitHub Advisory, Patch Commit).

• Network: Unexpected TCP connections to NATS cluster port (default 6222) or leafnode port (default 7422) from hosts not in the known peer list; connections that send PING as the first command without a preceding CONNECT message.
• Logs: NATS server logs showing a new route or leafnode connection established from an unexpected IP address without a corresponding CONNECT protocol entry; absence of authentication-related log entries for a route/leaf connection that is otherwise active.
• Behavior: Unexpected increase in the number of registered routes (NumRoutes) or leaf nodes (NumLeafNodes) as reported by the NATS server monitoring endpoint (/routez, /leafz); unexpected messages appearing on subjects that should only be accessible via inter-server routing.
• Monitoring Endpoint: Anomalous entries in /routez or /leafz HTTP monitoring endpoints showing connections from unauthorized IP addresses or with missing authentication metadata (GitHub Advisory).

Upgrade NATS Server to one of the patched versions: v2.11.16 (for 2.11.x deployments), v2.12.7 (for 2.12.x deployments), or v2.14.0 (for the latest branch). As an immediate workaround prior to upgrading, avoid combining no_auth_user with route or leafnode listeners — either remove the no_auth_user configuration option or restrict network access to route and leafnode listener ports to trusted peers only using firewall rules. Restricting cluster and leafnode ports to known server IPs at the network perimeter significantly reduces the attack surface regardless of patch status (GitHub Advisory, v2.11.16 Release).

The vulnerability was discovered and reported by the XlabAI Team of Tencent Xuanwu Lab, with the advisory published by NATS maintainer Neil Twigg (neilalexander) on June 29, 2026 (GitHub Advisory). A Bluesky post from cyberhub.blog noted the vulnerability shortly after public disclosure. No significant broader media coverage or notable community controversy has been observed beyond standard CVE tracking and aggregation sites.