CVE-2025-4922CWE-266

Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job

High · published June 11, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00510 · 42.6th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-06-11T13:24Z
EPSS history
Timeline
  • 11 JUN 13:24Z
    Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job
    cvelistv5