NATS Server is a high‑performance messaging broker used in cloud and edge environments. In versions before v2.14.0, v2.12.7, and v2.11.16, when the configuration option no_auth_user is set on a route or leafnode listener, the server mistakenly uses a client‑connection parsing routine that bypasses the CONNECT authentication step intended for inter‑server traffic. As a result, an external peer that establishes a network connection to the listener can authenticate as the configured no_auth_user and gain the elevated privileges of a route or leafnode. This enables the attacker to join the cluster, publish and subscribe to any topics, and potentially tamper with traffic that should be protected, thereby threatening confidentiality, integrity, and availability of cluster messaging. The weakness is classified as CWE‑287 (Authentication Bypass) and CWE‑551 (Client‑Authentication Improper Handling).

Any installation of NATS Server from the nats‑io organization that is running a version older than 2.14.0, 2.12.7, or 2.11.16 and has the no_auth_user setting enabled on inter‑server or leafnode listeners is affected. This encompasses deployments in which the broker serves as a route, leafnode, or cluster member with permissive authentication configured. The affected product is the NATS Server component of the NATS.io messaging system. No affected versions are known beyond those explicitly listed, and updates released after the advisory contain the patch.

The risk is quantified by a CVSS score of 8.8, which indicates high severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote network access to a listener port that accepts route or leafnode connections; the flaw allows the attacker to bypass authentication from outside the cluster. While the exploit requires the no_auth_user configuration to be enabled, once the bypass is applied, the attacker can operate with route or leafnode privileges, potentially disrupting or hijacking messaging traffic. As the exploit can occur over a standard TCP connection, adequate risk remains until the software is patched or misconfiguration is corrected.