CVE-2025-0937
Published: 12 February 2025
Summary
CVE-2025-0937 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Hashicorp Nomad. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0937 affects Nomad Community and Nomad Enterprise, where an event stream configured with a wildcard namespace can bypass ACL policies, enabling reads on other namespaces. This vulnerability, published on 2025-02-12T19:15:09.687, carries a CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and is classified under CWE-863 (Incorrect Authorization).
An attacker requires low privileges (PR:L) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high confidentiality impact (C:H) by allowing unauthorized reads of data in other namespaces, alongside low integrity impact (I:L) and no availability impact (A:N), without changing the scope (S:U).
The HashiCorp security advisory provides details on this issue at https://discuss.hashicorp.com/t/hcsec-2025-02-nomad-vulnerable-to-event-stream-namespace-acl-policy-bypass-through-wildcard-namespace/73191.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1934
Vulnerability details
Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
ACL bypass in Nomad event stream directly enables unauthorized cross-namespace data access, mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations in accordance with access control policies, directly preventing the ACL policy bypass via wildcard namespaces in Nomad event streams.
Requires identification, reporting, and correction of system flaws like the incorrect authorization in Nomad event streams allowing unauthorized namespace reads.
Applies least privilege to restrict low-privileged users from accessing data in other namespaces despite the authorization bypass.