Bypassing Sentinel Policies in Nomad Enterprise by HashiCorp
CVE-2025-3744

7.6HIGH

Key Information:

Vendor

Hashicorp
Status
Nomad Enterprise
Vendor
CVE Published:
13 May 2025

What is CVE-2025-3744?

Nomad Enterprise, a workload orchestration tool by HashiCorp, has a vulnerability where jobs utilizing the policy override feature can bypass mandatory sentinel policies during job submissions. This flaw can lead to unintended consequences in job execution, potentially compromising the intended security measures. The issue has been addressed in recent updates, specifically in versions 1.10.1, 1.9.9, and 1.8.13, ensuring that sentinel policies are enforced correctly. Users are advised to upgrade to these versions to maintain the integrity of their job submissions.

Affected Version(s)

Nomad Enterprise 64 bit 0 < 1.10.1

References

https://discuss.hashicorp.com/t/hcsec-2025-08-nomad-enter...

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-3744 : Bypassing Sentinel Policies in Nomad Enterprise by HashiCorp