CVE-2025-30215criticalCWE-287CWE-306

CVE-2025-30215: fallo crítico en nats-io nats-server

NATS-Server Fails to Authorize Certain Jetstream Admin APIs

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear nats-server+ Monitorear nats-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.6epss 0.6%
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Productos afectados
nats-io · nats-server
CVEs relacionadas — nats-io nats-server

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-58210HIGHNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memoryEPSS 0.7%CVE-2026-58250HIGHNATS Server: Pre-auth server crash via double INFO in leafnode handshakeEPSS 0.7%CVE-2026-29785HIGHNATS Server panic via malicious compression on leafnode portEPSS 0.7%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%CVE-2026-27889HIGHNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadEPSS 0.6%