medium6.5
CVE-2025-1296
Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs
Impact
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | <= 1.9.6 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Nomad | from 1.0.0 before 1.7.19 from 1.0.0 before 1.9.7 from 1.8.0 before 1.8.11 from 1.9.0 before 1.9.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737
- https://github.com/advisories/GHSA-c3q9-q986-vrwh
- https://nvd.nist.gov/vuln/detail/CVE-2025-1296
- https://github.com/hashicorp/nomad/commit/dc482bf9058faf7a192486eb52caa1d42646f6b3
- https://pkg.go.dev/vuln/GO-2025-3510