CVE-2025-1296

Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs

State: Published
Severity: 6.5 Medium
Published: Mar 10, 2025
Updated: Mar 11, 2025
Reserved: Feb 14, 2025

Description

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	HashiCorp

Weaknesses

CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
NomadHashiCorp	1.0.0 to before 1.9.7Affected
Nomad EnterpriseHashiCorp	1.0.0 to before 1.9.7Affectedfrom 1.8.11Not affectedfrom 1.7.19Not affected

References

https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.