Event Stream Namespace ACL Policy Bypass in Nomad by HashiCorp

CVE-2025-0937

What is CVE-2025-0937?

A vulnerability has been identified in Nomad Community and Nomad Enterprise where the event stream configured with a wildcard namespace could potentially allow unauthorized access. This issue can lead to reads on other namespaces due to the misconfiguration of ACL policies, significantly affecting the security boundaries set between them. Organizations using Nomad are advised to review their event stream configurations and implement necessary mitigations to ensure that access controls are effectively enforced.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References