HashiCorp Nomad CVE-2026-102260

Exploitation requires an authenticated Nomad or Nomad Enterprise user who already holds read permissions in at least one namespace (per CVSS PR:L); it is not reachable by anonymous or unauthenticated clients. The bypass affects specific read-only API endpoints, so only those endpoints leak cross-namespace object information - the sources do not enumerate exactly which endpoints or which object types are exposed. Impact is limited to information disclosure (C:L, no integrity or availability effect), and the issue is primarily meaningful in multi-tenant deployments that rely on namespaces as a security boundary; single-tenant or single-namespace clusters have little to disclose. The only complete fix stated by the vendor is upgrading to a fixed version.

This is a genuine but low-to-moderate priority issue, not a high-CVSS-but-low-risk inflation case - the CVSS base score of 4.3 is itself modest and honest. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) tells a consistent story: network-reachable and low-complexity, but requiring low privileges (PR:L - an authenticated user who already holds read permissions in at least one namespace) and yielding only limited confidentiality impact with no integrity or availability effect. The flaw is a cross-namespace authorization bypass (CWE-863) in several read-only API endpoints, so the real-world harm is information disclosure of objects in namespaces the user should not see - not code execution, data modification, or disruption. No EPSS score, KEV listing, POC, or SSVC machine-readable decision was supplied, so there is no signal of active or probable exploitation; the only priority signal is the vendor-feed 'this_month' decision label, which aligns with a patch-at-next-cycle posture rather than emergency response. The signals do not conflict - a low-privilege, read-only, confidentiality-only weakness with no exploitation evidence is coherently a standard-patch-cycle item. The main unknown is how sensitive the leaked cross-namespace metadata is in a given deployment, which the sources do not quantify.

An authenticated Nomad user who legitimately holds read permissions in one namespace sends requests to the affected read-only API endpoints and receives information about objects (jobs, allocations, or related metadata) belonging to other namespaces they are not authorized to view. No public exploit was identified at time of analysis, and the attack requires valid credentials with at least read access, making it most relevant in multi-tenant clusters where namespace isolation is a trust boundary.