CVE-2025-4922
📋 TL;DR
This vulnerability in Nomad's ACL policy lookup system can cause incorrect rule application and shadowing, potentially allowing unauthorized access to resources. It affects Nomad Community and Enterprise editions before specific patched versions. Organizations using vulnerable Nomad deployments for workload orchestration are at risk.
💻 Affected Systems
- Nomad Community Edition
- Nomad Enterprise
📦 What is this software?
Nomad by Hashicorp
Nomad by Hashicorp
Nomad by Hashicorp
Nomad by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass ACL policies to access sensitive job data, modify workloads, or escalate privileges within the Nomad cluster.
Likely Case
Unauthorized users might gain unintended access to job information or resources they shouldn't have permissions for.
If Mitigated
With proper network segmentation and minimal necessary permissions, impact would be limited to specific namespaces or jobs.
🎯 Exploit Status
Requires existing ACL policy access to exploit; detailed technical explanation available in advisory
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nomad Community 1.10.2, Nomad Enterprise 1.10.2, 1.9.10, or 1.8.14
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396
Restart Required: Yes
Instructions:
1. Backup Nomad configuration and data. 2. Download patched version from HashiCorp releases. 3. Stop Nomad service. 4. Replace binary with patched version. 5. Restart Nomad service. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict ACL Policy Complexity
allSimplify ACL policies to avoid complex prefix-based rules that trigger the vulnerability
Review and modify ACL policies to use exact matches instead of prefixes where possible
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Nomad clusters
- Apply principle of least privilege and audit all ACL policies for unnecessary prefix rules
🔍 How to Verify
Check if Vulnerable:
Check Nomad version with 'nomad version' and compare against affected versionsCheck Version:
nomad versionVerify Fix Applied:
Confirm version is 1.10.2 or higher (Community) or patched Enterprise versions, then test ACL policy behavior📡 Detection & Monitoring
Log Indicators:
- Unexpected ACL policy evaluation logs
- Unauthorized access attempts to job resources
Network Indicators:
- Unusual API calls to Nomad ACL endpoints from unexpected sources
SIEM Query:
source="nomad" AND ("ACL" OR "policy") AND ("denied" OR "unauthorized")