CVE-2025-3744

Published May 13, 2025

Last updated 10 months ago

Overview

Description
Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13.
Source
security@hashicorp.com
NVD status
Analyzed
Products
nomad

Risk scores

CVSS 3.1

Type
Primary
Base score
7.6
Impact score
4.7
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Severity
HIGH

Weaknesses

security@hashicorp.com
CWE-266
nvd@nist.gov
NVD-CWE-noinfo

Social media

Hype score
Not currently trending

Configurations