CVE-2025-30215

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.

• CWE-287
• CWE-306

• https://advisories.nats.io/CVE/secnote-2025-01.txt
• https://github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w
• http://www.openwall.com/lists/oss-security/2025/04/08/5
• https://github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w

Published

Apr 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3021Path Traversal vulnerability in e-solutions e-management. Th…8.7
• CVE-2025-30210Bruno is an open source IDE for exploring and testing APIs. …6.1
• CVE-2025-30211Erlang/OTP is a set of libraries for the Erlang programming …7.5
• CVE-2025-30212Frappe is a full-stack web application framework. An SQL Inj…7.5
• CVE-2025-30213Frappe is a full-stack web application framework. Prior to v…8.8
• CVE-2025-30214Frappe is a full-stack web application framework. Prior to v…7.5
• CVE-2025-30216CryptoLib provides a software-only solution using the CCSDS …9.1
• CVE-2025-30217Frappe is a full-stack web application framework. Prior to v…7.5
• CVE-2025-30218Next.js is a React framework for building full-stack web app…5.9
• CVE-2025-30219RabbitMQ is a messaging and streaming broker. Versions prior…6.1
• CVE-2025-3022Os command injection vulnerability in e-solutions e-manageme…9.3
• CVE-2025-30220GeoServer is an open source server that allows users to shar…9.1