CVE-2026-58251

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Improper Authorization pada linuxfoundation nats-server. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322 advisory vendor
• https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c patch
• https://github.com/nats-io/nats-server/commit/79c2f6e9ff87f594596337b6427dda85c38d1fe1 patch
• https://github.com/nats-io/nats-server/commit/b9ffb63b85e7db3d25a13b2e234f5f7f7c13164d patch
• https://github.com/nats-io/nats-server/releases/tag/v2.11.16 release notes
• https://github.com/nats-io/nats-server/releases/tag/v2.12.7 release notes
• https://github.com/nats-io/nats-server/releases/tag/v2.14.0 release notes