NATS Server CVE-2025-58211: Pre-Auth Connection Restriction Bypass via no_auth_user

Vulnerability Overview Vulnerability Name: pre-CONNECT fast path bypasses user connection restrictions CVE ID: CVE-2025-58211 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: None Severity: 5.4 / 10 Affected Versions Affected Versions: - - Affected: - Fixed in: Remediation Fixed Versions: - - Workaround Configuration Avoidance: - Do not configure with permissions that rely on or as the sole boundary for access control. References GHSA Advisory: GHSA-hmmp-q8cx-v964 Credit: Arthra Bodepu, Trial of Bits Background NATS.io is a high-performance, open-source pub/sub distributed communication technology designed for cloud, on-premise, IoT, and edge computing. The NATS server can map clients that do not send credentials to a configured . Users can also be restricted to specific connection types or require connections through a trusted proxy. Description A client can be registered as the configured via the parser path if the first client operation is not . This code path does not apply the same user-level connection restrictions that are enforced during normal authentication. Consequently, unauthorized clients can inherit the permissions of the default user, who is intended to be accessed only via specific connection types or through a trusted proxy. This issue affects deployments that use in conjunction with restrictions such as or . The impact depends on the permissions granted to the configured . Affected Versions Versions , , and earlier are vulnerable. The issue was fixed in and . Workaround Do not configure with permissions that rely on or as the sole boundary for access control. References GHSA Advisory: GHSA-hmmp-q8cx-v964 Credit: Arthra Bodepu, Trial of Bits Code Snippets in Page Screenshots No POC code or exploitation code.

Goal Reached Thanks to every supporter — we hit 100%!

NATS Server CVE-2025-58211: Pre-Auth Connection Restriction Bypass via no_auth_user

More from this source