Orta CVSS 4.3
CVE-2026-58214: Nats-server: hatalı yetkilendirme
Açıklama (NVD)
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.
Özet bilgiler
- Ürün
- Linuxfoundation Nats-server
- CVSS v3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- %0,35 (yüzdelik 29)
- CWE
- CWE-863
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| linuxfoundation-nats-server | — | — | 2.12.12 |
| linuxfoundation-nats-server | 2.14.0 | — | 2.14.3 |