Loading story…
A high-severity flaw in NATS Server tracked as CVE-2026-58253 allows unauthenticated peers to bypass authentication on inter-server route and leafnode listeners when the no_auth_user option is enabled. The bug stems from a parser fast path that was meant for ordinary client connections but was incorrectly applied to non-client connection types, allowing an attacker to skip the required CONNECT authentication step and inherit the privileges of that server-to-server connection. The issue is rated CVSS 8.8 and mapped to CWE-287 Improper Authentication.
Maintainers fixed the problem by restricting no_auth_user behavior to client connections only and enforcing that route, leafnode, and some gateway connections must begin with CONNECT before other protocol messages are accepted. Associated tests show that non-client peers sending PING first are now rejected, direct route-protocol message injection such as RMSG without CONNECT is blocked, and normal client behavior remains unchanged when no_auth_user is configured. The vulnerability affects releases before 2.14.0, 2.12.7, and 2.11.16, which contain the fix.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-58253 was disclosed as a high-severity improper authentication flaw in NATS Server affecting inter-server route and leafnode listeners when no_auth_user is configured. The advisory said versions prior to 2.14.0, 2.12.7, and 2.11.16 are affected and that the issue is fixed in those releases, with a CVSS 8.8 score.
Further NATS Server commits applied the same authentication/parsing fix, again limiting NoAuthUser behavior to client connections and preventing non-client protocol handling before CONNECT. The changes preserved normal client behavior while blocking abuse on route and leafnode listeners.
A NATS Server code change restricted the NoAuthUser fast-path to CLIENT connections only, requiring ROUTER, LEAF, and certain GATEWAY connections to begin with CONNECT. Associated tests verified that route and leaf connections sending PING first or injecting route messages without CONNECT are rejected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical server-side request forgery flaw in the **n8n** workflow automation platform, tracked as `CVE-2026-56348`, allowed any authenticated user to bypass the product’s Allowed HTTP Request Domains restriction and coerce the server into sending stored credentials to attacker-controlled hosts. The issue affected all versions before `2.20.0` and stemmed from missing credential permission validation in the `refineResourceIds()` path behind the `POST /rest/dynamic-node-parameters/options` endpoint, enabling exposure of API keys, OAuth tokens, and passwords without confirming `credential:read` access. n8n fixed the vulnerability by adding credential access checks through `CredentialsFinderService` and returning a `ForbiddenError` when validation fails, while no public proof-of-concept had been reported at disclosure. Separately, the Canadian Centre for Cyber Security issued an advisory urging organizations to review n8n’s latest vendor notices and apply updates affecting versions prior to `1.123.64`, `2.29.8`, and `2.30.1`, underscoring continued patching requirements across multiple release branches.
Jul 12, 2026
A high-severity server-side request forgery flaw tracked as **`CVE-2026-73160`** was disclosed in MISP's **cti-transmute** component, affecting the **`/fetch_misp_event`** and **`/misp_search_events`** endpoints. The issue stemmed from validation that blocked direct private or reserved IP literals but still accepted ordinary hostnames without resolving them first, allowing an unauthenticated attacker to supply a domain that resolved to an internal address and force the server to send requests into its internal network and return the responses. The vulnerability is rated **CVSS 4.0 8.7 (High)** and is mapped to **`CWE-918`**. MISP addressed the flaw by updating URL validation to resolve hostnames with **`socket.getaddrinfo()`** and reject targets if any resolved address is not globally routable, covering private, loopback, link-local, and reserved destinations. The fix also added **login protection** to both affected routes, reducing exposure of functionality that queries external MISP instances. Project notes indicate some residual DNS rebinding or post-validation DNS swap risk may remain for limited probing, but response-body exposure is constrained because valid TLS certificates are required for the hostname and redirects are not followed.
Aug 11, 2026
Rapid7 disclosed a chain of two vulnerabilities in **N-able N-central** that allows a remote unauthenticated attacker to create an attacker-controlled System administrator account. `CVE-2026-86206`, a medium-severity access-control flaw, stems from inconsistent URI and `Forwarded` header parsing between Envoy, Jetty, and N-central, enabling access to local-only SOAP services. `CVE-2026-86207`, rated high severity, bypasses legacy two-factor authentication; together, the flaws permit acquisition of a pre-login session, conversion to a privileged session for built-in accounts, and creation of a new privileged user. The flaws constitute an authentication-bypass condition consistent with **CWE-305** and affect all N-central releases before **2026.3 Hotfix 3** (`2026.3.1.13`). N-able has fixed the issues in that release; organizations operating on-premises N-central should apply the update urgently and review for unexpected privileged accounts or suspicious SOAP-service access. Hosted N-central customers do not need to take action because N-able has deployed the fixes.
Sep 9, 2026