AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-c3q9-q986-vrwh

Nomad: secrets in logs

Nomad

CVE-2025-1296 · Published Mar 10, 2025 · updated Mar 14, 2025

Medium6.5
No fix yet
GitHub advisory

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
<= 1.9.6No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-532
Also known as
CVE-2025-1296, GO-2025-3510

More Nomad advisories

All Nomad
High 8.1Jun 11, 2025Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2025-4922fixed in 1.10.2Medium 6.5Dec 20, 2024Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2024-12678fixed in 1.9.4Medium 7.7Nov 7, 2024Hashicorp Nomad Incorrect Authorization vulnerabilityCVE-2024-10975no fix yetMedium 5.8Aug 15, 2024Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingCVE-2024-7625fixed in 1.6.14 +2High 7.7Jul 23, 2024HashiCorp Nomad is vulnerable to path escape through archive unpacking during migrationCVE-2024-6717fixed in 1.8.2High 7.7Feb 8, 2024HashiCorp Nomad vulnerable to symlink attacksCVE-2024-1329fixed in 1.5.14 +2