Event Stream Namespace ACL Policy Bypass in Nomad by HashiCorp

CVE-2025-0937

What is CVE-2025-0937?

A vulnerability has been identified in Nomad Community and Nomad Enterprise where the event stream configured with a wildcard namespace could potentially allow unauthorized access. This issue can lead to reads on other namespaces due to the misconfiguration of ACL policies, significantly affecting the security boundaries set between them. Organizations using Nomad are advised to review their event stream configurations and implement necessary mitigations to ensure that access controls are effectively enforced.

References