Vulnerability · Published Apr 15, 2025 · Assigned by GitHub_M
CVE-2025-30215NATS-Server Fails to Authorize Certain Jetstream Admin APIs
Critical 9.6
In plain English
A critical-severity missing authentication in nats-server from nats-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | nats-server | 2.10.27-r0 | ALPINE-CVE-2025-30215 |
| Alpine:v3.22 | nats-server | 2.10.27-r0 | ALPINE-CVE-2025-30215 |
| Alpine:v3.23 | nats-server | 2.10.27-r0 | ALPINE-CVE-2025-30215 |
| Alpine:v3.24 | nats-server | 2.10.27-r0 | ALPINE-CVE-2025-30215 |
| Debian:12 | nats-server | no fix listed | DEBIAN-CVE-2025-30215 |
| Debian:13 | nats-server | 2.10.27-1 | DEBIAN-CVE-2025-30215 |
| Debian:14 | nats-server | 2.10.27-1 | DEBIAN-CVE-2025-30215 |
| Go | github.com/nats-io/nats-server/v2 | 2.10.27, 2.11.1 | GO-2025-3600 |
| Go | github.com/nats-io/nats-server/v2 | 2.11.1 | GHSA-fhg8-qxh5-7q3w |
| Go | github.com/nats-io/nats-server/v2 | 2.10.27 | GHSA-fhg8-qxh5-7q3w |
| Ubuntu:24.04:LTS | nats-server | no fix listed | UBUNTU-CVE-2025-30215 |
| Ubuntu:25.10 | nats-server | no fix listed | UBUNTU-CVE-2025-30215 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nats-io | nats-server | >= 2.2.0, < 2.10.27>= 2.11.0-RC.1, < 2.11.1 |
Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H