Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2025-30215

critical

CVE-2025-30215

nats-server: NATS-Server Fails to Authorize Certain Jetstream Admin APIs

Published Modified CWE 287, 306
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

GHSA9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Red Hat9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Bitnami9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by GHSA, Red Hat, Azure Linux, Bitnami, CBL-Mariner.

Description

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.

Affected packages and fixed versions

SourcePackageFixed in
Azure Linux 3.0telegraf0:1.31.0-9.azl3
bitnami::Bitnami Vulnerability Databasenats2.11.1
CBL-Mariner 2.0telegraf0:1.29.4-15.cm2
go::GitHub Security Advisory Gogithub.com/nats-io/nats-server/v22.11.1, 2.10.27
alpine 3.21nats-server2.10.27-r0
alpine 3.22nats-server2.10.27-r0
alpine 3.23nats-server2.10.27-r0
alpine 3.24nats-server2.10.27-r0
alpine edgenats-server2.10.27-r0
chainguardnats-server, nats-server-fips, nats-top and 2 more2.12.1-r1 and 4 more
debian 12nats-serverno fix listed
debian 13nats-server2.10.27-1
Show all 24 entries from 18 sources
SourcePackageFixed in
Azure Linux 3.0telegraf0:1.31.0-9.azl3
bitnami::Bitnami Vulnerability Databasenats2.11.1
CBL-Mariner 2.0telegraf0:1.29.4-15.cm2
go::GitHub Security Advisory Gogithub.com/nats-io/nats-server/v22.11.1, 2.10.27
alpine 3.21nats-server2.10.27-r0
alpine 3.22nats-server2.10.27-r0
alpine 3.23nats-server2.10.27-r0
alpine 3.24nats-server2.10.27-r0
alpine edgenats-server2.10.27-r0
chainguardnats-server2.12.1-r1
chainguardnats-server-fips2.12.1-r0
chainguardnats-top0.6.3-r3
chainguardnats-top-fips0.6.3-r2
chainguardprometheus-nats-exporter0.17.2-r2
debian 12nats-serverno fix listed
debian 13nats-server2.10.27-1
debian 14nats-server2.10.27-1
echonats-server2.10.27-1
rapidfort debian 12nats-server0:2.10.27-1
rapidfort debian 13nats-server0:2.10.27-1
seal go::Seal Security Databasegithub.com/nats-io/nats-server/v22.9.24-sp999
seal go::Seal Security Databasesealsecurity.io/github.com/nats-io/nats-server/v22.9.24-sp999
wolfinats-server2.12.1-r1
wolfinats-top0.6.3-r3

References

All 9 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.