GHSA-c3q9-q986-vrwh

Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-1296

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/nomad	<= 1.9.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-1296 advisory
https://github.com/hashicorp/nomad/commit/dc482bf9058faf7a192486eb52caa1d42646f6b3 web
https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737 web
https://github.com/hashicorp/nomad package
https://pkg.go.dev/vuln/GO-2025-3510 web