CVE-2025-1296CWE-532

Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

Medium · published March 10, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-03-10T18:02Z
EPSS history
Timeline
  • 10 MAR 18:02Z
    Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs
    cvelistv5