high8.1
CVE-2025-4922
Hashicorp Nomad Incorrect Privilege Assignment vulnerability
Impact
Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | < 1.10.2 | 1.10.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Nomad | from 1.4.0 before 1.8.14 from 1.4.0 before 1.10.2 from 1.9.0 before 1.9.10 from 1.10.0 before 1.10.2 |