CVE-2025-1296 Common Vulnerabilities and Exposures

Upstream information

CVE-2025-1296 at MITRE

Description

Nomad Community and Nomad Enterprise ("Nomad") are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
	CNA (HashiCorp)
Base Score	6.5
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	None
Availability Impact	None
CVSSv3 Version	3.1

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

openSUSE-SU-2025:14893-1, published Sun Mar 16 18:51:13 2025

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Tumbleweed	`govulncheck-vulndb >= 0.0.20250313T170021-1.1`	Patchnames: openSUSE-Tumbleweed-2025-14893

SUSE Timeline for this CVE

CVE page created: Mon Mar 10 20:00:22 2025
CVE page last modified: Sun Mar 16 20:08:43 2025