GO-2025-3600 Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server

🗓️ 22 Apr 2025 15:29:23Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Missing access controls on JavaScript APIs lead to potential privilege escalation risks.

Reporter	Title	Published	Views	Family All 39
IBM Security Bulletins	Security Bulletin: A flaw was found in NATS-SERVER which affect IBM watsonx.data	16 Jul 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to API abuse due to the NATS-Server package (CVE-2025-30215)	11 Aug 202522:06	–	ibm
AlpineLinux	CVE-2025-30215	15 Apr 202523:25	–	alpinelinux
Tenable Nessus	Azure Linux 3.0 Security Update: telegraf (CVE-2025-30215)	23 Apr 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: telegraf (CVE-2025-30215)	23 Apr 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-30215	21 Aug 202500:00	–	nessus
BDU FSTEC	The vulnerability of the NATS messaging system’s server lies in the lack of access control elements for the JetStream API. This allows attackers to delete data.	11 Apr 202500:00	–	bdu_fstec
CBLMariner	CVE-2025-30215 affecting package telegraf for versions less than 1.29.4-15	22 Apr 202521:14	–	cbl_mariner
CBLMariner	CVE-2025-30215 affecting package telegraf for versions less than 1.31.0-9	22 Apr 202515:08	–	cbl_mariner
Chainguard	CVE-2025-30215 vulnerabilities	16 Apr 202513:13	–	cgr

Source	Link
github	www.github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w
advisories	www.advisories.nats.io/CVE/secnote-2025-01.txt
github	www.github.com/nats-io/nats-server/commit/3e7e4645a24e829a36b4210f2d7c34dea7f7a424

04 Feb 2026 03:25Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.6

EPSS0.00529

SSVC

missing access controls privilege escalation javascript apis nats server