AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

NomadGHSA-rx97-6c62-55mf

Hashicorp Nomad Incorrect Privilege Assignment vulnerability

Nomad

CVE-2025-4922 · Published Jun 11, 2025 · updated Jul 28, 2025

High8.1
Fix: upgrade to 1.10.2 or later
GitHub advisory

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
< 1.10.21.10.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266
Also known as
CVE-2025-4922, GO-2025-3758

More Nomad advisories

All Nomad
High 8.8May 12HashiCorp Nomad vulnerable to a path traversalCVE-2026-7474fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099aMedium 6.5Mar 10, 2025Nomad: secrets in logsCVE-2025-1296no fix yetMedium 6.5Dec 20, 2024Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2024-12678fixed in 1.9.4Medium 7.7Nov 7, 2024Hashicorp Nomad Incorrect Authorization vulnerabilityCVE-2024-10975no fix yetMedium 5.8Aug 15, 2024Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingCVE-2024-7625fixed in 1.6.14 +2High 7.7Jul 23, 2024HashiCorp Nomad is vulnerable to path escape through archive unpacking during migrationCVE-2024-6717fixed in 1.8.2