CVE-2025-4922

HIGH EPSS 37.4%

Published Jun 11, 20251y ago · Modified Jun 17, 20262w ago

8.1 CVSS 3.1

High

Published Jun 11, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

CVSS Details

Base Score

8.1

Exploitability

2.8

Impact

5.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

37.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-266

Affected Products 4

Vendor	Product	Version	Range
hashicorp	nomad	*	≥1.4.0 – <1.8.14
hashicorp	nomad	*	≥1.4.0 – <1.10.2
hashicorp	nomad	*	≥1.9.0 – <1.9.10
hashicorp	nomad	*	≥1.10.0 – <1.10.2

References 1

discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.