Skip to content
OpenAdvisories
High · 7.1 CVE-2025-0937 EUVD-2025-1934GHSA-5mx9-vcf9-4hvc

Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace

Published Feb 12, 2025 · Updated Feb 12, 2025 · Assigned by HashiCorp

Vendor: HashiCorp Product: Nomad Product: Nomad Enterprise Package: nomad Ecosystem: Ubuntu

Description

Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.

Affected products

VendorProductAffectedFixed
HashiCorp Nomad 1.0.0 – < 1.9.6 1.9.6
HashiCorp Nomad Enterprise 1.0.0 – < 1.9.6 1.9.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS nomad No fix yet —
Ubuntu 18.04 LTS nomad No fix yet —

References