CVE-2026-58209

Katalog CVE

CVSS 4.3 · Medium EPSS 0,34%

Kerentanan Incorrect Authorization pada linuxfoundation nats-server. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg advisory vendor
• https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356 patch
• https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87 patch
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 release notes
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 release notes