CVE-2026-58254
NixOS vulnerability analysis and mitigation

Overview

CVE-2026-58254 is an incorrect authorization vulnerability in NATS Server (the high-performance messaging server for NATS.io) that allows a leafnode operator to bypass Nats-Trace-Dest publish permission checks. The flaw is an incomplete fix for a prior related issue (CVE-2026-33249): message trace destination checks were enforced for ordinary client connections but not consistently applied to messages arriving via leafnode connections. Affected versions are all releases prior to 2.12.8 and 2.14.0-RC.1 through 2.14.2 (i.e., prior to 2.14.3). It was disclosed on June 29, 2026 via a GitHub Security Advisory and published to NVD on July 8, 2026. The CVSS v3.1 base score is 6.5 (Medium), and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, Feedly).

Technical details

The root cause is CWE-863 (Incorrect Authorization): the allowedToPublishOnMsgTraceDest function in server/msgtrace.go checked publish permissions only for connections with explicit perms set, but did not apply the equivalent check for connections of kind LEAF. As a result, a leafnode operator could set the Nats-Trace-Dest header on a message to an arbitrary subject — including subjects the leafnode's credentials would not normally be permitted to publish to — and the hub server would forward trace events to that unauthorized destination. Additionally, by using Nats-Trace-Only: true, the attacker could suppress normal delivery or storage of the affected message. The fix (commit cbe8459) adds a branch for LEAF-kind connections that calls leafReceiveAllowed or leafSendAllowed depending on whether the node is a spoke or hub-side leaf, enforcing the correct permission model (GitHub Advisory, Fix Commit).

Impact

A leafnode operator exploiting this vulnerability can send trace events — which may include routing, subscription, account, service import, and JetStream metadata — to subjects they are not authorized to access, resulting in limited confidentiality and integrity impacts. While the payload of the original application message is not exposed through the trace event itself, sensitive infrastructure metadata can be leaked. Additionally, by leveraging trace-only behavior, an attacker can prevent normal delivery or storage of targeted messages, disrupting message flow within the NATS cluster without triggering standard delivery failures (GitHub Advisory, Feedly).

Exploitation steps

  1. Reconnaissance: Identify a NATS Server instance running a vulnerable version (< 2.12.8 or 2.14.0–2.14.2) that exposes a leafnode port. Leafnode ports are typically configured separately from client ports in the server configuration.
  2. Establish a leafnode connection: Connect to the leafnode port using valid leafnode credentials (e.g., CONNECT {"user":"leaf","pass":"pwd","headers":true}) over a raw TCP connection, enabling header support.
  3. Craft a malicious HMSG frame: Construct a NATS protocol HMSG frame targeting an allowed publish subject (e.g., pub.ok) but with the Nats-Trace-Dest header pointing to an unauthorized subject (e.g., secret.trace): HMSG pub.ok <hdr_len> <total_len>\r\nNATS/1.0\r\nNats-Trace-Dest: secret.trace\r\nNats-Trace-Only: true\r\n\r\n<payload>\r\n.
  4. Trigger unauthorized trace delivery: Send the crafted frame. The vulnerable server skips the leafnode-specific permission check and forwards trace events (containing routing, subscription, account, and JetStream metadata) to the unauthorized secret.trace subject.
  5. Suppress message delivery (optional): By including Nats-Trace-Only: true, the attacker prevents normal delivery or storage of the message, effectively dropping it from the intended recipients without raising a standard delivery error (GitHub Advisory, Fix Commit).

Indicators of compromise

  • Network: Unexpected leafnode connections from untrusted or unknown IP addresses to the NATS leafnode port; HMSG frames from leafnode connections containing Nats-Trace-Dest headers pointing to subjects outside the leafnode's permitted publish paths.
  • Logs: NATS server error logs showing Publish Violation entries referencing unauthorized trace destination subjects from leafnode connections; absence of expected message delivery logs for messages that were sent with Nats-Trace-Only: true (messages silently dropped).
  • Behavioral: Trace events appearing on subjects that no client or leafnode should be authorized to publish to; JetStream or subscription metadata appearing in unexpected subjects; messages failing to reach intended subscribers without corresponding error responses to publishers (GitHub Advisory, Fix Commit).

Mitigation and workarounds

Upgrade NATS Server to version 2.14.3 or 2.12.8, which contain the fix for this vulnerability. As a partial workaround where upgrading is not immediately possible, avoid granting publish paths from less-trusted leafnodes into subjects for which trace-only behavior would affect delivery guarantees; no other configuration-based workaround is available. Additionally, restrict which systems are permitted to establish leafnode connections using network-level access controls (firewall rules on the leafnode port) and review leafnode credential permissions to apply the principle of least privilege (GitHub Advisory, v2.14.3 Release, v2.12.8 Release).

Community reactions

The vulnerability was reported by security researcher Koda Reef and credited in both the GitHub Security Advisory and the v2.14.3 release notes. The advisory was published by NATS maintainer neilalexander on June 29, 2026. No significant broader media coverage or notable community discussion beyond the official advisory and standard vulnerability database entries has been observed (GitHub Advisory, v2.14.3 Release).

Additional resources


SourceThis report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-45568CRITICAL9.9
  • Python logoPython
  • zrok
NoYesJul 16, 2026
CVE-2026-45576HIGH8.3
  • NixOS logoNixOS
  • zrok
NoYesJul 16, 2026
CVE-2026-36590HIGH7.5
  • NixOS logoNixOS
  • nanomq
NoNoJul 15, 2026
CVE-2026-59259MEDIUM6
  • NixOS logoNixOS
  • n8n
NoYesJul 15, 2026
CVE-2026-26032MEDIUM5.4
  • NixOS logoNixOS
  • ivy
NoYesJul 15, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management