← back
CVE-2025-1296

Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

CVSS 6.5 MEDIUMEPSS 0.4%CWE-532
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
10 Mar 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
HashiCorp · NomadHashiCorp · Nomad Enterprise

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737