MQTT Message Delivery Bypass in NATS Server

Executive Summary

CVE-2026-58209 is a vulnerability in the NATS Server affecting MQTT message delivery. Specifically, the issue occurs because MQTT retained message delivery and QoS1+ durable replay could deliver messages to subscribers even if those messages' original topics matched a subscribe deny rule configured for that subscriber. This happens because these delivery paths did not consistently recheck the original topic against the deny rules before sending the MQTT PUBLISH message. As a result, subscribers could receive messages they were explicitly denied access to.

The vulnerability affects versions 2.14.2 and below, as well as 2.12.11 and below, and is fixed in versions 2.14.3 and 2.12.12. The weakness is classified as incorrect authorization (CWE-863).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized delivery of MQTT messages to subscribers who should have been denied access based on their subscription deny rules. In practical terms, a subscriber with broad wildcard subscribe permissions but specific denied topics could still receive messages from those denied topics due to the flaw in retained message and QoS1+ replay delivery paths.

The impact is that sensitive or restricted information could be exposed to unauthorized subscribers, potentially leading to information leakage. The CVSS score of 4.3 indicates a moderate severity with low attack complexity and requiring low privileges.

There is no known workaround other than upgrading to a patched version (2.14.3 or 2.12.12). Deployments not using MQTT are not affected.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your NATS Server to version 2.14.3 or 2.12.12 or later, as these versions include the fix that enforces subscribe deny permissions on retained message delivery and QoS1+ durable replay paths.

There is no known workaround for deployments requiring MQTT, so upgrading is the recommended immediate action. Deployments not using MQTT are unaffected by this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized delivery of MQTT messages to subscribers despite subscribe deny rules, potentially exposing data that should have been restricted.

This unauthorized message delivery could lead to violations of data protection and privacy requirements found in standards like GDPR and HIPAA, which mandate strict access controls and data confidentiality.

Therefore, if sensitive or regulated data is transmitted via MQTT on affected NATS Server versions, this vulnerability could compromise compliance by allowing unintended recipients to access protected information.

Upgrading to fixed versions (2.14.3 or 2.12.12) is recommended to restore proper enforcement of subscribe deny permissions and help maintain compliance.

Useful 0 Not Useful 0