CVE-2025-4922: Hashicorp Nomad

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

Affected products

• Hashicorp Nomad: from 1.4.0, before 1.8.14 (fixed in 1.8.14); from 1.4.0, before 1.10.2 (fixed in 1.10.2); from 1.9.0, before 1.9.10 (fixed in 1.9.10); from 1.10.0, before 1.10.2 (fixed in 1.10.2)

Published 2025-06-11. Last modified 2026-06-17.