GitHub Advisoryadvisory · Go

GHSA-c3q9-q986-vrwh Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs

MEDIUM Published 2025-03-10 Modified 2025-03-14 Official page ↗
Aliases
CVE-2025-1296
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2025-03-10

Affected packages

• Go github.com/hashicorp/nomad: <= 1.9.6 (no fix yet)

Description

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

Related

Alias · CVE (1)

  • CVE-2025-1296 Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References