CVEvulnerability

CVE-2025-1296

6.5 MEDIUM Published 2025-03-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-03-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532

Description

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

Affected configurations

• hashicorp nomad (>= 1.0.0 < 1.7.19) • hashicorp nomad (>= 1.0.0 < 1.9.7) • hashicorp nomad (>= 1.8.0 < 1.8.11) • hashicorp nomad (>= 1.9.0 < 1.9.7)

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References