CVE-2025-30215criticalCWE-287CWE-306

CVE-2025-30215: falha crítica em nats-io nats-server

NATS-Server Fails to Authorize Certain Jetstream Admin APIs

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nats-server+ Monitorar nats-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.6epss 0.6%
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Produtos afetados
nats-io · nats-server
CVEs relacionadas — nats-io nats-server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58210HIGHNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memoryEPSS 0.7%CVE-2026-58250HIGHNATS Server: Pre-auth server crash via double INFO in leafnode handshakeEPSS 0.7%CVE-2026-29785HIGHNATS Server panic via malicious compression on leafnode portEPSS 0.7%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%CVE-2026-27889HIGHNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadEPSS 0.6%