CVE-2025-1296: Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs
First published: Mon Mar 10 2025(Updated: )
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Credit: security@hashicorp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/hashicorp/nomad | <=1.9.6 | |
| HashiCorp Nomad | <1.9.7 | |
| HashiCorp Nomad | >=1.7.19<1.9.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737
- https://nvd.nist.gov/vuln/detail/CVE-2025-1296
- https://github.com/hashicorp/nomad/commit/dc482bf9058faf7a192486eb52caa1d42646f6b3
- https://pkg.go.dev/vuln/GO-2025-3510
- https://github.com/advisories/GHSA-c3q9-q986-vrwh (Advisory)
Frequently Asked Questions
What is the vulnerability ID CVE-2025-1296 about?
CVE-2025-1296 pertains to the unintentional exposure of workload identity and client secret tokens in the audit logs of HashiCorp Nomad.
What versions are affected by CVE-2025-1296?
CVE-2025-1296 affects HashiCorp Nomad Community Edition versions up to 1.9.6 and Nomad Enterprise versions from 1.7.19 up to 1.9.6.
How do I remediate CVE-2025-1296?
To remediate CVE-2025-1296, you should upgrade to Nomad Community Edition version 1.9.7 or Nomad Enterprise version 1.9.7 or 1.8.11.
Is there a risk of data leakage with CVE-2025-1296?
Yes, CVE-2025-1296 poses a risk of data leakage due to the exposure of sensitive tokens in audit logs.
What is the importance of fixing CVE-2025-1296?
Fixing CVE-2025-1296 is crucial to protect sensitive credentials and maintain the security integrity of your Nomad deployments.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/nvd-cve
- agent/source
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c3q9-q986-vrwh
- alias/CVE-2025-1296
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- package-manager/go
- vendor/hashicorp
- canonical/hashicorp nomad