What is the CVSS score of CVE-2025-4922?

CVE-2025-4922 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-4922?

Within 24 hours: Inventory all Nomad deployments and identify versions running Community or Enterprise editions prior to 1.10.2 (Enterprise versions 1.9.10 and 1.8.14). Within 7 days: Implement network segmentation to restrict Nomad API access and review ACL policies for potential shadowing issues. Within 30 days: Upgrade all affected Nomad instances to patched versions (1.10.2 or later for Community; 1.10.2, 1.9.10, or 1.8.14 for Enterprise).

Nomad CVE-2025-4922

Q: Which versions of Nomad are affected by CVE-2025-4922?

CVE-2025-4922 affects HashiCorp Nomad's access control system, potentially allowing unauthorized users to bypass security policies through ACL rule shadowing.. A patch is available.

EUVD-2025-18112 HIGH

Incorrect Privilege Assignment (CWE-266)

2025-06-11 security@hashicorp.com

GHSA-rx97-6c62-55mf

Information Disclosure Hashicorp Nomad Suse

8.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-266 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Privilege assignment review
Impact	CVSS 8.1. EPSS 0.0%. No patch confirmed.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in the affected application to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

CVE-2025-4922 is a security vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 21:09 CVSS 8.1

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad C

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

Nomad Enterprise 1.4.0 <1.10.2

Nomad 1.4.0 <1.10.2

Affected Packages

go github.com/hashicorp/nomad fix: 1.10.2

euvd nomad fix: 1.10.2

euvd nomad_enterprise fix: 1.10.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type not specified by vendor. CVSS 8.1 indicates high severity.

Know when Nomad gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Ubuntu MEDIUM

SUSE HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Jun 11, 2025 - 14:15 nvd

HIGH 8.1

DescriptionCVE.org

Executive ViewAI

Why It Matters

CVE-2025-4922 affects HashiCorp Nomad's access control system, potentially allowing unauthorized users to bypass security policies through ACL rule shadowing. This vulnerability impacts organizations using Nomad for infrastructure orchestration and could lead to unauthorized access to sensitive workloads and data if exploited.

Business Impact: High

Compensating Controls

Until patching is complete: (1) Restrict Nomad API access through network segmentation and firewall rules limiting connectivity to trusted administrative networks only; (2) Implement reverse proxy or WAF rules to monitor and log all ACL policy lookup requests; (3) Disable or restrict use of prefix-based ACL policies where possible, converting to explicit exact-match policies; (4) Increase audit logging and alerting for ACL policy violations; (5) Conduct immediate review of current ACL policy configurations to identify and remediate any shadowing scenarios.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Nomad

View all

CVE-2023-1782 CRITICAL Act Now

9.8 Apr 05

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL autho

CVE-2022-30324 CRITICAL Act Now

9.8 Jun 02

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privi

CVE-2020-7956 CRITICAL Act Now

9.8 Jan 31

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates use

CVE-2019-12618 CRITICAL Act Now

9.8 Aug 12

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. Rated critical severity (CVSS 9.8)

CVE-2020-27195 CRITICAL Act Now

9.1 Oct 22

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using eithe

CVE-2026-7474 HIGH This Week

8.8 May 12

Authenticated code execution on Nomad client hosts is possible in HashiCorp Nomad and Nomad Enterprise 1.10.0 through ve

CVE-2023-1299 HIGH This Week

8.8 Mar 14

HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using worklo

CVE-2021-43415 HIGH This Week

8.8 Dec 03

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenti

CVE-2021-37218 HIGH This Week

8.8 Sep 07

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same

CVE-2024-6717 HIGH This Week

8.6 Jul 23

HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to p

CVE-2026-14373 HIGH This Week

7.7 Jul 08

Host namespace escape in HashiCorp Nomad and Nomad Enterprise lets an authenticated job submitter bypass the allow_privi

CVE-2024-10975 HIGH This Week

7.7 Nov 07

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume cr

Same weakness CWE-266 – Incorrect Privilege Assignment

View all

CVE-2025-27007 CRITICAL POC

9.8

CVE-2024-28000 CRITICAL POC

9.8

CVE-2026-48172 CRITICAL POC

10.0

CVE-2024-24882 CRITICAL POC

9.8

CVE-2025-47539 CRITICAL POC

9.8

CVE-2022-20759 HIGH POC

8.8

CVE-2024-54363 CRITICAL

9.8

CVE-2026-23550 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Ubuntu

Priority: Medium

nomad

Release	Status	Version
bionic	needs-triage	-
focal	needs-triage	-
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
upstream	needs-triage	-
questing	DNE	-

Debian

nomad

Release	Status	Fixed Version	Urgency
(unstable)	fixed	(unfixed)	-

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed

References

Advisories & patches

ADVISORY https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396 ADVISORY https://github.com/hashicorp/nomad ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-4922

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back