CVE-2025-4922: Hashicorp Nomad Incorrect Privilege Assignment Vulnerability
Summary
CVE-2025-4922: Hashicorp Nomad Incorrect Privilege Assignment vulnerability. Affects github.com/hashicorp/nomad versions < 1.10.2. Fixed in 1.10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Hashicorp Nomad is a flexible, enterprise-grade orchestrator for deploying and managing applications across a cluster of machines. It provides a single, unified workflow for managing both containerized and non-containerized applications. Nomad's prefix-based ACL (Access Control List) policy system is designed to ensure that users have the appropriate permissions to perform actions within the system. However, a vulnerability has been identified that can lead to incorrect rule application, potentially allowing unauthorized access to resources.
Vulnerability Detail
The vulnerability, identified as CVE-2025-4922, arises from the prefix-based ACL policy lookup mechanism in Nomad. This flaw can result in incorrect rule application and shadowing, where a less restrictive rule may inadvertently override a more restrictive one. As a consequence, users may gain access to resources and functionalities that they should not have permission to use, leading to potential data breaches or unauthorized actions within the Nomad environment.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.2
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.10.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can review and adjust their ACL policies to ensure that more restrictive rules are not shadowed by less restrictive ones. This may involve manually auditing the existing policies and ensuring that they are correctly configured to prevent unauthorized access.
Conclusion
CVE-2025-4922 represents a significant vulnerability in Hashicorp Nomad that could lead to unauthorized access due to incorrect privilege assignments. Users are strongly advised to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
CVE-2025-4922 is a vulnerability in Hashicorp Nomad that allows for incorrect privilege assignments due to flaws in the prefix-based ACL policy lookup.
The vulnerability can lead to unauthorized access to resources, allowing users to perform actions they should not be permitted to, potentially resulting in data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of Nomad prior to 1.10.2 are affected by this vulnerability.
The CVSS score of CVE-2025-4922 is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
