PT-2025-25213 · Hashicorp+1 · Nomad+1

Published 2025-06-11 · Updated 2025-12-22 · CVE-2025-4922

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Hashicorp Nomad versions prior to 1.10.2 Hashicorp Nomad versions prior to 1.9.10 Hashicorp Nomad versions prior to 1.8.14

Description The issue is related to prefix-based ACL policy lookup in Nomad Community and Nomad Enterprise, which can lead to incorrect rule application and shadowing.

Recommendations For versions prior to 1.10.2, update to Nomad Community Edition 1.10.2 or later. For versions prior to 1.9.10, update to Nomad Enterprise 1.9.10 or later. For versions prior to 1.8.14, update to Nomad Enterprise 1.8.14 or later.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-06807

CVE-2025-4922

GHSA-RX97-6C62-55MF

GO-2025-3758

OPENSUSE-SU-2025:15405-1

Affected Products

Nomad

Red Os

References · 75

• https://nvd.nist.gov/vuln/detail/CVE-2025-4922 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3758 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4922 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-4922 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4922 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4922 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06807 · Security Note
• https://osv.dev/vulnerability/GHSA-rx97-6c62-55mf · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://suse.com/security/cve/CVE-2025-0928 · Note
• https://suse.com/security/cve/CVE-2025-54059 · Note
• https://suse.com/security/cve/CVE-2025-51471 · Note
• https://suse.com/security/cve/CVE-2025-3228 · Note