CVE-2025-1296 Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

Nomad Community and Nomad Enterprise “Nomad” are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19...

CVE-2025-1296

CVE-2025-1296 affects Nomad Community Edition and Nomad Enterprise. The issue is unintentional exposure of workload identity tokens and client secret tokens in audit logs, caused by logging of sensitive credentials. Fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1....

CVE-2025-1296 Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

Nomad Community and Nomad Enterprise “Nomad” are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19...

Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

Summary Nomad Community and Nomad Enterprise “Nomad” are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and...

HashiCorp Nomad Enterprise 日志信息泄露漏洞

HashiCorp Nomad Enterprise is a professional version of Nomad software from HashiCorp, Inc. A log information disclosure vulnerability exists in HashiCorp Nomad Enterprise that stems from unintentional exposure of workload identity tokens and client key tokens in audit logs...

PT-2025-10607

Name of the Vulnerable Software and Affected Versions Nomad Community and Nomad Enterprise versions prior to 1.9.7 Nomad Enterprise versions prior to 1.8.11 Nomad Enterprise versions prior to 1.7.19 Description The issue concerns unintentional exposure of the workload identity token and client...

ROS-20250307-12

Nomad application orchestrator vulnerability related to customization of wildcard namespace usage. namespace. Exploitation of the vulnerability could allow an attacker acting remotely to bypass ACL policy by allowing reads from other namespaces. ACL policy by allowing reads from other namespaces...

ROS-20250212-11

The Nomad application orchestrator vulnerability is related to improper assignment of privileges in the namespace namespace privileges via unedited workload identification tokens. Exploitation of the vulnerability could allow an attacker acting remotely to access sensitive information...

CVE-2025-0937

Nomad Community and Nomad Enterprise "Nomad" event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces...

UBUNTU-CVE-2025-0937

Nomad Community and Nomad Enterprise "Nomad" event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces...

CVE-2025-0937 Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace

Nomad Community and Nomad Enterprise "Nomad" event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces...

CVE-2025-0937 Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace

Nomad Community and Nomad Enterprise "Nomad" event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces...

CVE-2025-0937

Summary: CVE-2025-0937 affects Nomad Community and Nomad Enterprise. An event stream configured with a wildcard namespace can bypass ACL policy, allowing reads from other namespaces. What’s affected: Nomad’s event stream endpoint within Nomad Community and Nomad Enterprise. The underlying issue i...

CVE-2025-0937 Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace

Nomad Community and Nomad Enterprise "Nomad" event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces...

Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace

Summary Nomad Community and Nomad Enterprise “Nomad” event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. This vulnerability, identified as CVE-2025-0937, is fixed in Nomad Community Edition 1.9.6 and Nomad Enterprise 1.9.6, 1.8.10, and...

HashiCorp Nomad 安全漏洞

HashiCorp Nomad is a simple and flexible scheduler and orchestrator from the US-based HashiCorp Inc. for managing containerized and non-containerized applications at scale, both locally and in the cloud. HashiCorp Nomad suffers from a security vulnerability that stems from the fact that Nomad eve...

CVE-2024-1329

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14...

CVE-2024-10975

Nomad Community and Nomad Enterprise "Nomad" volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface CSI volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad...

CVE-2024-6717

HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2...

ROS-20250128-09

A vulnerability in the Container Storage Interface CSI component of the Nomad application orchestrator is related to an improper authorization. Exploitation of the vulnerability could allow an attacker acting remotely, Affect the integrity of protected information...