PT-2025-21028 · Hashicorp · Nomad Enterprise

Published 2025-05-13 · Updated 2025-05-15 · CVE-2025-3744

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Nomad Enterprise versions prior to 1.10.1 Nomad Enterprise versions prior to 1.9.9 Nomad Enterprise versions prior to 1.8.13

Description: Nomad Enterprise jobs using the policy override option are bypassing the mandatory sentinel policies.

Recommendations: For versions prior to 1.10.1, update to Nomad Enterprise 1.10.1 to resolve the issue. For versions prior to 1.9.9, update to Nomad Enterprise 1.9.9 to resolve the issue. For versions prior to 1.8.13, update to Nomad Enterprise 1.8.13 to resolve the issue.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-3744

Affected Products

Nomad Enterprise

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-3744 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3744 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2025-08-nomad-enterprise-vulnerable-to-violation-of-mandatory-sentinel-policies-in-job-submissions-via-policy-override/74935 · Vendor Advisory
• https://twitter.com/CVEnew/status/1922369630305452198 · Twitter Post
• https://t.me/cvenotify/122371 · Telegram Post