CVE-2025-1296
Fixed in a distro release EPSS <1%CVSS 6.5
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Products: HashiCorp Nomad, HashiCorp Nomad Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/nomad | no fix |
| Go | github.com/hashicorp/nomad | 1.9.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 18.04 LTS | nomad | no fix |
| Ubuntu 20.04 LTS | nomad | no fix |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250313T170021-1.1 |