PatchTheCVEnomad vulnerabilities and fixes
Recent CVEs affecting nomad, with upgrade or downgrade steps. 6 tracked.
nomad has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-06-11. Highest priority: CVE-2025-4922 (score 39/100).
- CVE-2025-4922 HIGH 8.1 UPGRADE Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule appli
- CVE-2025-3744 HIGH 7.6 UPGRADE Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies
- CVE-2025-1296 MEDIUM 6.5 UPGRADE Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identi
- CVE-2025-0937 HIGH 7.1 UPGRADE Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass th
- CVE-2024-12678 MEDIUM 6.5 UPGRADE Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a nam
- CVE-2024-10975 HIGH 7.7 UPGRADE Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace
FAQ
How do I fix nomad vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nomad being exploited right now?
None of the tracked nomad CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nomad CVE should I patch first?
CVE-2025-4922 currently ranks highest (39/100): Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule appli.