CVE-2025-30215: NATS Server authorization bypass in JetStream admin APIs

Executive brief

NATS Server, a high-performance messaging system, contains a vulnerability in its JetStream management component. An authenticated user with basic permissions can bypass security boundaries to delete data or disrupt services belonging to other accounts. This could lead to total data loss or significant service outages across a shared NATS infrastructure.

Technical details

NATS Server fails to enforce proper authorization checks on four administrative JetStream APIs: account purge, server remove, account stream move, and account stream cancel-move. The root cause is a lack of restriction to the system account; any user with permission to publish to the '$JS.>' subject namespace can trigger these actions. An attacker can exploit this to delete all JetStream data for any account (via $JS.API.ACCOUNT.PURGE) or disrupt cluster topology. The vulnerability is patched in versions 2.10.27 and 2.11.1.

Affected products

• NATS NATS Server >= 2.2.0, < 2.10.27; >= 2.11.0-RC.1, < 2.11.1

Timeline

• 2025-04-15: advisory: GHSA-fhg8-qxh5-7q3w published
• 2025-04-15: disclosed
• 2025-04-15: patched

References

• https://api.github.com/users/zarqman
• https://github.com/zarqman
• https://api.github.com/users/zarqman/gists%7B/gist_id%7D
• https://api.github.com/users/zarqman/repos
• https://avatars.githubusercontent.com/u/22556?v=4
• https://api.github.com/users/zarqman/events%7B/privacy%7D