Prior to NATS‑Server versions 2.11.15 and 2.12.6, message subject ACLs were not enforced for the $MQTT.> namespace. An MQTT client can therefore publish or subscribe to subjects that should be restricted, revealing sensitive information or allowing tampering with traffic. The weakness arises from improper ACL enforcement and is classified as CWE‑425 and CWE‑863.

The vulnerability affects the NATS‑io NATS‑Server product. Any installation running a version older than 2.11.15 or 2.12.6 is exposed; the CPE string indicates the Linux Foundation’s NATS‑Server.

The CVSS score of 7.1 denotes high severity, while the EPSS score of less than 1 percent indicates a relatively low likelihood of exploitation in the wild. The issue is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is likely a legitimate MQTT client that connects to the server; no special authentication bypass is required. Exploitation would allow an attacker to read or publish to prohibited subjects, compromising confidentiality and integrity of messaging.