CVE-2026-58251 – NATS Server: Queue Subscribe Authz Bypass

CVE ID :CVE-2026-58251

Published : July 8, 2026, 7:40 p.m. | 8 minutes ago

Description :NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…