Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-58211 is a medium-severity Incorrect Authorization (CWE-863) vulnerability in Linuxfoundation Nats-Server. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42390
Vulnerability Data
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was…
more
not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply. This issue is fixed in versions 2.14.3 and 2.12.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows an unauthenticated client to register as the configured no_auth_user by exploiting a parser path when the first operation is not CONNECT, bypassing authentication restrictions. This directly enables T1078 (Valid Accounts) by impersonating a legitimate account and T1190 (Exploit Public-Facing Application) as NATS Server is a network-facing messaging service.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces that every client connection is subject to the configured authentication and authorization rules, blocking the bypass of no_auth_user restrictions.
Requires identification and authentication of every organizational user before granting access, eliminating the parser-path that allowed unauthenticated registration as no_auth_user.
Boundary-protection mechanisms can be configured to reject or isolate connections that do not present a valid CONNECT frame, limiting exposure to the vulnerable parser path.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.
By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.