CVE-2025-4922 describes a critical vulnerability in HashiCorp Nomad Community and Enterprise editions, where prefix-based Access Control List (ACL) policy lookups can result in incorrect rule application and shadowing. This flaw, rated 8.1 HIGH on the CVSS scale, allows an authenticated attacker to achieve high confidentiality and integrity impacts without user interaction. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and there is no evidence of active exploitation or significant community discussion, the vulnerability's high FAUCET Risk Score of 76/100 indicates its potential severity. Organizations using affected versions of Nomad should upgrade to Nomad Community Edition 1.10.2 or Nomad Enterprise 1.10.2, 1.9.10, or 1.8.14 to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.4.0, < 1.8.14CPE matchmatch criteria | cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* | ||
>= 1.4.0, < 1.10.2CPE matchmatch criteria | cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* | ||
>= 1.9.0, < 1.9.10CPE matchmatch criteria | cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* | ||
>= 1.10.0, < 1.10.2CPE matchmatch criteria | cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.