NatJack Attacks Manipulate NAT Connection State to Hijack TCP Streams and Spoof DNS
Executive Summary
At Black Hat USA 2026, security researcher Malcolm Stagg unveiled a novel, systemic attack class dubbed NatJack. The attack exploits fundamental design vulnerabilities in Network Address Translation (NAT) connection tracking engines, allowing malicious actors operating behind a shared NAT gateway or within multi-tenant cloud/container environments to manipulate internal translation tables. By exploiting these flaws, unauthenticated attackers behind the same gateway can hijack active TCP connections, inject forged DNS responses, force internal port exposures, and cause denial-of-service (DoS) via NAT translation pool exhaustion. The vulnerability class encompasses two major implementation-specific CVEs: CVE-2026-56181 (CVSS 8.3) affecting Windows NAT (Hyper-V) and CVE-2026-63913 (CVSS 8.2) impacting Linux Netfilter conntrack.
Source reference: The Hacker News — NatJack Attacks Hijack TCP Sessions and Spoof DNS
Deep-Dive Technical Analysis of NatJack
NAT connection tables maintain mapping state between internal private IP/port combinations and external public-facing IP/port mappings. Connection tracking (conntrack) modules inspect packet headers to dynamically assign translation rules for outbound and inbound traffic.
Stagg demonstrated that NatJack exploits the predictable or permissive nature of how NAT engines handle incoming packets that match existing or quasi-open connection states:
* TCP Session Hijacking: When an internal victim initiates an outbound TCP connection to a remote server, the NAT gateway allocates a public source port. An attacker sharing the same NAT gateway predicts or monitors the translation tuple and sends crafted TCP packets matching the external translation state. The NAT engine improperly updates its internal routing table or passes the injected packets through to the victim, allowing the attacker to inject malicious data, hijack TCP sequence numbers, or reset active sessions.
* DNS Cache Poisoning & Response Spoofing: When internal workloads issue unencrypted UDP DNS queries to external resolvers, NatJack allows an attacker on the same local segment or container bridge to race the legitimate response. By inserting pre-emptive NAT mapping entries or exploiting conntrack UDP state loose-matching, the attacker injects spoofed DNS A/AAAA records, redirecting the victim's traffic to attacker-controlled infrastructure.
* Internal Mapped Port Exposure: By sending specially crafted inbound packets to the shared NAT public IP, the attacker can force the NAT engine into creating unintended port forwarding rules, effectively exposing private internal services (such as administrative interfaces or unauthenticated APIs) to local or external network access.
* NAT Pool Exhaustion (DoS): Attackers can rapidly exhaust the gateway's state table or available port translation pool by generating thousands of ephemeral connection states, preventing legitimate internal systems from establishing outbound connections.
Implementation-Specific Vulnerabilities
The NatJack attack manifests differently depending on the underlying operating system and NAT implementation. Stagg highlighted two critical vulnerabilities that allow for the manipulation of translation states.
CVE ID
Affected Component
CVSS
Mechanism
CVE-2026-56181
Windows NAT (WinNAT) / Hyper-V
8.3
Failure to validate source boundaries of incoming state-creation packets; allows cross-tenant interception.
CVE-2026-63913
Linux Netfilter Conntrack
8.2
Loose state matching (nf_conntrack_tcp_loose=1) allows attackers to satisfy conditions and overwrite tuple rules.
CVE-2026-56181: Windows NAT (Hyper-V) Connection Table Manipulation
This vulnerability affects the Windows NAT (WinNAT) driver used extensively in Hyper-V virtual networking, Windows Containers, and WSL2. WinNAT failed to adequately validate the source boundary of incoming state-creation packets. A compromised VM or container on a Hyper-V virtual switch could manipulate WinNAT state entries, allowing cross-tenant container interception and TCP stream injection.
CVE-2026-63913: Linux Netfilter Conntrack State Injection
Impacting the Linux kernel net/netfilter/nf_conntrack_* subsystem, this vulnerability arises from the NAT engine allowing loose state matching for UDP and TCP state transitions under default sysctl settings. An attacker sharing a network namespace or bridge interface could inject packets that satisfied loose state conditions, overwriting tuple translation rules and hijacking connections.
Source reference: The Hacker News — NatJack Attacks Hijack TCP Sessions and Spoof DNS
Industry Impact & Environmental Exposure
NatJack introduces severe risks across several widely deployed network architectures:
* Multi-Tenant Cloud Hosts: Shared hypervisors or cloud instances utilizing host-level NAT translation (such as AWS, Azure, or GCP virtual private clouds with NAT Gateways).
* Container Orchestration Platforms: Kubernetes clusters, Docker bridges, and CNI plugins relying on Linux Netfilter/iptables for pod-to-pod or egress translation.
* Shared Corporate & Enterprise Gateways: Enterprise office networks, public Wi-Fi environments, and hotel/conference networks where hundreds of untrusted devices share a single egress NAT IP.
Actionable Mitigations & Defense Playbook
To defend against NatJack exploits, network administrators and system architects should implement the following defensive measures:
Strategy
Action Items
Immediate Patching
Install August 2026 security updates for Windows Server/11 and upgrade Linux kernels to patched builds.
Kernel Hardening
Set sysctl -w net.netfilter.nf_conntrack_tcp_loose=0 on Linux hosts to reject out-of-window packets.
Network Filtering
Deploy IP Source Guard, eBPF filters, and strict reverse-path filtering (rp_filter=1) on virtual bridges.
Traffic Encryption
Implement end-to-end TLS 1.3, mTLS, or IPsec for all internal service-to-service communications.
DNS Security
Transition internal workloads to DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to prevent UDP racing.
Isolation
Separate tenant containers and untrusted VMs into isolated VLANs or dedicated namespaces.
Source reference: The Hacker News — NatJack Attacks Hijack TCP Sessions and Spoof DNS
Authored by Person