CVE-2025-0937 — Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace

CVE-2025-0937

Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace PUBLISHED

Description (CNA)

Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Nomad	affected 1.0.0 before 1.9.6
HashiCorp / Nomad Enterprise	affected 1.0.0 before 1.9.6

CWE

CWE-863

References

https://discuss.hashicorp.com/t/hcsec-2025-02-nomad-vulnerable-to-event-stream-namespace-acl-policy-bypass-through-wildcard-namespace/73191

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.