9.6

CVE-2025-30215: nats-io nats-server Improper Authentication

CVSS: 9.6v3.1CriticalDeferred
AliasesMGASA-2026-0232UBUNTU-CVE-2025-30215DEBIAN-CVE-2025-30215
Published 15-04-2025Last modified 17-04-2025
Open JSON

Vulnerability summary

CVE-2025-30215 is a critical (CVSS 9.6) Improper Authentication vulnerability in nats-io nats-server. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.6/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.60%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 3
CGA-PR58-VGG3-MFCCCGA-QFR6-6XGX-436GCGA-V26X-GH9W-5JMF

Timeline

  1. 15-04-2025
    PublishedVulnerability first disclosed.
  2. 17-04-2025
    Last modifiedVulnerability information updated.

Description

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

+0.01 pp

From 0.59% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard7 products
  • nats-server< 2.12.1-r1
  • nats-server-fips< 2.12.1-r0
  • nats-top< 0.6.3-r3
  • nats-top-compat< 0.6.3-r3
  • nats-top-fips< 0.6.3-r2
Mageia6 products
  • golang-github-nats-io< 1.41.1-1.mga9
  • golang-github-nats-io-jwt< 2.5.2-1.mga9
  • golang-github-nats-io-nkeys< 0.4.10-1.mga9
  • golang-github-prashantv-gostub< 1.1.0-1.mga9
  • golang-uber-automaxprocs< 1.6.0-1.mga9
Wolfi3 products
  • nats-server< 2.12.1-r1
  • nats-top< 0.6.3-r3
  • nats-top-compat< 0.6.3-r3
Debian1 product
  • nats-serverAll versions (No fix recorded) | < 2.10.27-1
Github.com/nats-io/nats-server1 product
  • v2≥ 2.11.0-RC.1, < 2.11.1 | ≥ 2.2.0, < 2.10.27 | ≥ 2.11.0, < 2.11.1
Nats-io1 product
  • nats-server≥ 2.2.0, < 2.10.27 | ≥ 2.11.0-RC.1, < 2.11.1
Opensuse1 product
  • govulncheck-vulndb&distro=openSUSE Tumbleweed< 0.0.20250422T152923-1.1
Ubuntu1 product
  • nats-serverAll versions (No fix recorded)

8 vendors · 21 products

References

15 links
Show all 15 references