What is the CVSS score of CVE-2025-1296?

CVE-2025-1296 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Suse are affected by CVE-2025-1296?

CVE-2025-1296 presents notable security risk, a log file exposure vulnerability rated CVSS 6.5. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2025-1296?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Suse CVE-2025-1296

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2025-03-10 security@hashicorp.com

GHSA-c3q9-q986-vrwh

Information Disclosure Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 19:50 vuln.today

CVE Published

Mar 10, 2025 - 18:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

AnalysisAI

Technical ContextAI

Classified as CWE-532 (Insertion of Sensitive Information into Log File). Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

Affected ProductsAI

Fixed in: Nomad Community Edition 1

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Same weakness CWE-532 – Insertion of Sensitive Information into Log File

View all

CVE-2023-43261 HIGH POC

7.5

CVE-2025-24984 MEDIUM

4.6

CVE-2017-8075 CRITICAL POC

9.8

CVE-2017-8074 CRITICAL POC

9.8

CVE-2026-22778 CRITICAL POC

9.8

CVE-2019-17395 CRITICAL POC

9.8

CVE-2019-17398 CRITICAL POC

9.8

CVE-2019-17394 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.2-3.57	Affected
Container suse/sl-micro/6.0/base-os-container:2.1.2-3.34 Container suse/sl-micro/6.0/kvm-os-container:2.1.2-3.51 Container suse/sl-micro/6.0/rt-os-container:2.1.2-4.25 Container suse/sl-micro/6.0/toolbox:13.2-6.14	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed

CVE-2025-1296 vulnerability details – vuln.today

Back

Suse CVE-2025-1296

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-532 – Insertion of Sensitive Information into Log File

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code