Event Stream Namespace ACL Policy Bypass in Nomad by HashiCorp
CVE-2025-0937

7.1HIGH

Key Information:

Vendor
Hashicorp
Vendor
CVE Published:
12 February 2025

Summary

A vulnerability has been identified in Nomad Community and Nomad Enterprise where the event stream configured with a wildcard namespace could potentially allow unauthorized access. This issue can lead to reads on other namespaces due to the misconfiguration of ACL policies, significantly affecting the security boundaries set between them. Organizations using Nomad are advised to review their event stream configurations and implement necessary mitigations to ensure that access controls are effectively enforced.

Affected Version(s)

Nomad 64 bit 1.0.0 < 1.9.6

Nomad Enterprise 64 bit 1.0.0 < 1.9.6

References

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.