HashiCorp Nomad Enterprise up to 1.8.12/1.9.8/1.10.0 privileges assignment

Summaryinfo

A vulnerability was found in HashiCorp Nomad Enterprise up to 1.8.12/1.9.8/1.10.0. It has been rated as critical. Affected is an unknown function. This manipulation causes privileges assignment. This vulnerability is handled as CVE-2025-3744. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in HashiCorp Nomad Enterprise up to 1.8.12/1.9.8/1.10.0. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a privileges assignment vulnerability. The CWE definition for the vulnerability is CWE-266. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13.

It is possible to read the advisory at discuss.hashicorp.com. This vulnerability is known as CVE-2025-3744 since 04/16/2025. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.8.13, 1.9.9 or 1.10.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• HashiCorp

Name

• Nomad Enterprise

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10
• 1.8.11
• 1.8.12
• 1.9
• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.10.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion