NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In     versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens     with messages in the $JS. subject namespace in the system account; this is partially exposed into regular     accounts to allow account holders to manage their assets. Some of the JS API requests were missing access     controls, allowing any user with JS management permissions in any account to perform certain     administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows     for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is     fixed in v2.11.1 or v2.10.27. (CVE-2025-30215)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In
    versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens
    with messages in the $JS. subject namespace in the system account; this is partially exposed into regular
    accounts to allow account holders to manage their assets. Some of the JS API requests were missing access
    controls, allowing any user with JS management permissions in any account to perform certain
    administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows
    for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is
    fixed in v2.11.1 or v2.10.27. (CVE-2025-30215)

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30215 advisory.

  - NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In     versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens     with messages in the $JS. subject namespace in the system account; this is partially exposed into regular     accounts to allow account holders to manage their assets. Some of the JS API requests were missing access     controls, allowing any user with JS management permissions in any account to perform certain     administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows     for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is     fixed in v2.11.1 or v2.10.27. (CVE-2025-30215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of telegraf installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30215 advisory.

  - NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In     versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens     with messages in the $JS. subject namespace in the system account; this is partially exposed into regular     accounts to allow account holders to manage their assets. Some of the JS API requests were missing access     controls, allowing any user with JS management permissions in any account to perform certain     administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows     for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is     fixed in v2.11.1 or v2.10.27. (CVE-2025-30215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253113	Linux Distros Unpatched Vulnerability : CVE-2025-30215	Nessus	Misc.	critical
434250	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-fhg8-qxh5-7q3w)	Tenable Cloud Security	SCA Checks	critical
434250	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-fhg8-qxh5-7q3w)	Tenable Self-Hosted Container Security	SCA Checks	critical
426048	Alpine: nats-server: security update to 2.10.27-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426048	Alpine: nats-server: security update to 2.10.27-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
234744	CBL Mariner 2.0 Security Update: telegraf (CVE-2025-30215)	Nessus	MarinerOS Local Security Checks	critical
234742	Azure Linux 3.0 Security Update: telegraf (CVE-2025-30215)	Nessus	Azure Linux Local Security Checks	critical

Detections

Analytics

CVE-2025-30215

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical