6.5

CVE-2025-1296

Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hashicorp ≫ Nomad SwEditionenterprise Version >= 1.0.0 < 1.7.19
Hashicorp ≫ Nomad SwEdition- Version >= 1.0.0 < 1.9.7
Hashicorp ≫ Nomad SwEditionenterprise Version >= 1.8.0 < 1.8.11
Hashicorp ≫ Nomad SwEditionenterprise Version >= 1.9.0 < 1.9.7
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.402
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@hashicorp.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.