BIT-NATS-2025-30215 NATS-Server Fails to Authorize Certain Jetstream Admin APIs

🗓️ 18 Apr 2025 19:17:14Reported by GoogleType

osv

osv🔗 osv.dev👁 8 Views

NATS-Server allowed unauthorized management of JetStream assets, risking data destruction before 2.11.1.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: A flaw was found in NATS-SERVER which affect IBM watsonx.data	16 Jul 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to API abuse due to the NATS-Server package (CVE-2025-30215)	11 Aug 202522:06	–	ibm
AlpineLinux	CVE-2025-30215	15 Apr 202523:25	–	alpinelinux
Tenable Nessus	Azure Linux 3.0 Security Update: telegraf (CVE-2025-30215)	23 Apr 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: telegraf (CVE-2025-30215)	23 Apr 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-30215	21 Aug 202500:00	–	nessus
BDU FSTEC	The vulnerability of the NATS messaging system’s server lies in the lack of access control elements for the JetStream API. This allows attackers to delete data.	11 Apr 202500:00	–	bdu_fstec
CBLMariner	CVE-2025-30215 affecting package telegraf for versions less than 1.29.4-15	22 Apr 202521:14	–	cbl_mariner
CBLMariner	CVE-2025-30215 affecting package telegraf for versions less than 1.31.0-9	22 Apr 202515:08	–	cbl_mariner
Chainguard	CVE-2025-30215 vulnerabilities	16 Apr 202513:13	–	cgr

Source	Link
openwall	www.openwall.com/lists/oss-security/2025/04/08/5
advisories	www.advisories.nats.io/CVE/secnote-2025-01.txt
github	www.github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-30215

20 May 2025 10:02Current

9High risk

Vulners AI Score9

CVSS 3.19.6

EPSS0.00561

SSVC

nats-server vulnerability jetstream asset access control data destruction risk version 2.11.1