CVE-2026-102260: Nomad vulnerable to cross-namespace information disclosure in multiple endpoints

Published Oct 29, 2026

Updated

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Other sources

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

— NVD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HashiCorp Nomad Community Edition to a version that resolves this vulnerability.
Fixed in 2.1.1
Upgrade
Upgrade HashiCorp Nomad Enterprise to a version that resolves this vulnerability.
Fixed in 2.1.0
Upgrade
Upgrade HashiCorp Nomad Enterprise to a version that resolves this vulnerability.
Fixed in 1.11.12
Upgrade
Upgrade HashiCorp Nomad Enterprise to a version that resolves this vulnerability.
Fixed in 1.10.18

Event History

Oct 29, 2026

CVE Published

via MITRE·06:05 PM

Data Sourced

via MITRE·06:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user who has read permission in one Nomad namespace may be able to view information about objects in other namespaces through affected read-only API endpoints.

What is the impact of successful exploitation?

The impact is information disclosure across namespace boundaries. The provided data does not indicate that the issue permits modification or deletion of objects.

Which releases contain fixes?

Nomad Enterprise fixes are listed for versions 2.1.0, 1.11.12, and 1.10.18. For Nomad Community Edition, the data lists both 2.1.0 and 2.1.1 as fixed; verify the applicable vendor advisory before relying on the 2.1.0 statement.