
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-58254 is an incorrect authorization vulnerability in NATS Server (nats-io/nats-server) that allows a leafnode operator to bypass message trace destination (Nats-Trace-Dest) permission checks. The flaw is an incomplete fix for a prior related issue (CVE-2026-33249): trace destination checks were enforced for ordinary client connections but not consistently applied to messages arriving via leafnode connections. Affected versions are all releases prior to 2.12.8 and 2.14.0-RC.1 through 2.14.2. It was disclosed on June 29, 2026 via a GitHub Security Advisory and published to NVD on July 8, 2026. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, Feedly).
The root cause is CWE-863 (Incorrect Authorization): the allowedToPublishOnMsgTraceDest function in server/msgtrace.go checked publish permissions for regular client connections but omitted equivalent checks for connections of kind LEAF. This allowed a leafnode operator to set the Nats-Trace-Dest header to any subject — including ones the leafnode's credentials would not normally be permitted to publish to — and optionally use Nats-Trace-Only: true to suppress normal message delivery or storage of affected messages. The fix adds explicit leafReceiveAllowed/leafSendAllowed checks for spoke and hub leaf connections respectively, mirroring the permission enforcement already applied to regular clients. Trace events can expose routing, subscription, account, service import, and JetStream metadata, though the payload of the original application message is not directly exposed through the trace event itself (GitHub Advisory, Fix Commit).
A leafnode operator can send trace events to unauthorized subjects, potentially exposing sensitive infrastructure metadata including routing topology, subscription lists, account details, service import configurations, and JetStream metadata. Additionally, by combining an unauthorized trace destination with Nats-Trace-Only behavior, an attacker can prevent normal delivery or storage of targeted messages, causing selective message loss or denial of service for specific subjects. The confidentiality and integrity impacts are limited in scope (partial), and there is no direct availability impact at the system level, but message-level disruption in cloud-native or edge messaging pipelines could have significant downstream effects (GitHub Advisory, Feedly).
pub.ok and trace.ok).Nats-Trace-Dest set to an unauthorized subject (e.g., secret.trace) and optionally include Nats-Trace-Only: true to suppress normal message delivery.HMSG frame over the leafnode TCP connection, publishing to an allowed subject (e.g., pub.ok) while pointing the trace destination at the unauthorized subject.Nats-Trace-Only: true, prevent normal delivery or storage of the targeted messages, causing selective message loss for affected subjects (Fix Commit, GitHub Advisory).Nats-Trace-Dest headers pointing to subjects outside the leafnode's permitted publish paths.Nats-Trace-Only abuse); unexpected trace event traffic on sensitive subjects such as those prefixed with account, routing, or JetStream metadata namespaces (GitHub Advisory, Fix Commit).Upgrade NATS Server to version 2.14.3 or 2.12.8, which contain the fix for this vulnerability. As a workaround where immediate upgrade is not possible, avoid granting publish paths from less-trusted leafnodes into subjects for which trace-only behavior would affect delivery guarantees. Additionally, implement network-level access controls to restrict which systems can establish leafnode connections to your NATS infrastructure, and review leafnode connection configurations to limit which nodes are permitted to act as leafnodes. No other workarounds are available aside from upgrading (GitHub Advisory, v2.14.3 Release, v2.12.8 Release).
The vulnerability was reported by security researcher Koda Reef and credited in both the GitHub Security Advisory and the v2.14.3 release notes. The advisory was published by NATS maintainer neilalexander on June 29, 2026, and the fix was committed by Maurice van Veen. No significant broader media coverage or notable community discussion beyond the official advisory has been identified (GitHub Advisory, v2.14.3 Release).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."