UBUNTU-CVE-2026-102260: Medium severity ubuntu/nomad vulnerability

Published Nov 3, 2026

Updated

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Affected Software

2 affected components

ubuntu/nomad*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HashiCorp Nomad Community Edition to a version that resolves this vulnerability.
Fixed in 2.1.1
Upgrade
Upgrade HashiCorp Nomad Enterprise to a version that resolves this vulnerability.
Fixed in 2.1.0
Upgrade
Upgrade HashiCorp Nomad Enterprise to a version that resolves this vulnerability.
Fixed in 1.11.12
Upgrade
Upgrade HashiCorp Nomad Enterprise to a version that resolves this vulnerability.
Fixed in 1.10.18

Event History

Nov 3, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated Nomad user who has read permissions in one namespace may be able to view information about objects in other namespaces through affected read-only API endpoints.

What is the impact of successful exploitation?

The issue can disclose information across namespace boundaries. The provided severity vector indicates low confidentiality impact and no integrity or availability impact.

Which Nomad versions contain the fix?

The issue is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.