GHSA-c3q9-q986-vrwhMediumCVSS 6.5

Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs

Published
March 10, 2025
Last Modified
March 14, 2025

🔗 CVE IDs covered (1)

CVE-2025-1296 →

📋 Description

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

🎯 Affected products1

  • go/github.com/hashicorp/nomad:<= 1.9.6

🔗 References (5)