NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Medium4.2CVE-2026-33248 · Published Mar 24, 2026 · updated Sep 10, 2026

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate. ### Problem Description When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. ### Affected Versions Fixed in nats-server 2.12.6 & 2.11.15 ### Workarounds Developers should review their CA issuing practices.