| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/nomad | ≤ 1.9.6< 1.9.7 | 1.9.7 |
| nomad | ≥ 1.0.0, < 1.7.19≥ 1.0.0, < 1.9.7≥ 1.8.0, < 1.8.11≥ 1.9.0, < 1.9.7 | 1.7.191.9.71.8.11 |
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free