CVE-2025-1296: Hashicorp Nomad Token Disclosure Vulnerability

CVE-2025-1296 Overview

HashiCorp Nomad Community and Nomad Enterprise expose sensitive workload identity tokens and client secret tokens in audit logs. The flaw, tracked as CVE-2025-1296, affects the workload orchestrator's audit logging subsystem. Any operator or process with read access to Nomad audit logs can harvest these tokens and impersonate the associated workloads or clients. HashiCorp fixed the issue in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19. The vulnerability is classified as Insertion of Sensitive Information into Log File [CWE-532] and requires network access with low privileges to exploit.

Critical Impact
Attackers with access to Nomad audit logs can extract workload identity tokens and client secret tokens, enabling impersonation of workloads and unauthorized cluster actions.

Affected Products

HashiCorp Nomad Community Edition versions prior to 1.9.7
HashiCorp Nomad Enterprise versions prior to 1.9.7, 1.8.11, and 1.7.19
Nomad deployments with audit logging enabled

Discovery Timeline

2025-03-10 - CVE-2025-1296 published to the National Vulnerability Database
2025-03-10 - HashiCorp publishes Security Advisory HCSEC-2025-04
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1296

Vulnerability Analysis

Nomad writes structured audit records for API requests processed by the server. The audit pipeline failed to redact two categories of sensitive credentials before serializing records to disk. Workload identity tokens, which allow Nomad-scheduled tasks to authenticate to Nomad and Consul, appeared in cleartext. Client secret tokens, which authenticate Nomad clients to the server, were likewise written without masking. Any principal able to read the audit log file, ship it to a Security Information and Event Management (SIEM) platform, or access a backup could recover these credentials.

Root Cause

The vulnerability maps to [CWE-532: Insertion of Sensitive Information into Log File]. Nomad's audit filter did not include the workload identity token field or the client secret token field in its redaction list. As a result, request payloads containing these values were persisted verbatim. Audit logs are commonly treated as lower-sensitivity data and forwarded to central log stores, which broadens the exposure beyond the Nomad host.

Attack Vector

Exploitation requires read access to Nomad audit logs. That access can be obtained through compromised log aggregation infrastructure, over-permissive file system access on Nomad servers, exposed backups, or an insider with routine log-review duties. Once a token is recovered, the attacker can call the Nomad HTTP API with the credential to submit jobs, read secrets bound to the workload, or register clients, depending on the token type and its associated policies. See the HashiCorp Security Advisory HCSEC-2025-04 for vendor details.

Detection Methods for CVE-2025-1296

Indicators of Compromise

Presence of unredacted workload identity JSON Web Tokens (JWTs) or client secret UUIDs in Nomad audit log entries prior to patching
API requests to Nomad endpoints using tokens that were previously observed in audit logs
Unexpected job submissions, allocation stops, or ACL policy queries originating from workload identity tokens outside of their normal execution context

Detection Strategies

Grep or query centralized log stores for JWT patterns (eyJ) and UUID patterns within Nomad audit log streams to identify historical exposure
Correlate Nomad API access logs with source IP addresses that do not match the expected client or workload host
Enable and review Nomad ACL token accessor audit records to detect reuse of tokens outside their expected scope

Monitoring Recommendations

Forward Nomad server and audit logs to a centralized analytics platform and alert on token-shaped strings appearing in cleartext
Monitor for anomalous authentication activity against the Nomad HTTP API, particularly from log-aggregation subnets or backup restoration hosts
Track access to audit log storage locations and restrict read permissions to a minimum set of operators

How to Mitigate CVE-2025-1296

Immediate Actions Required

Upgrade Nomad Community Edition to 1.9.7 or later, and Nomad Enterprise to 1.9.7, 1.8.11, or 1.7.19 depending on the deployed release train
Rotate all workload identity tokens and client secret tokens that may have been written to audit logs prior to patching
Purge or restrict access to historical audit log files and backups that contain exposed tokens

Patch Information

HashiCorp addressed CVE-2025-1296 by extending the audit log redaction logic to mask workload identity tokens and client secret tokens. Apply Nomad Community Edition 1.9.7, or Nomad Enterprise 1.9.7, 1.8.11, or 1.7.19. Refer to HashiCorp Security Advisory HCSEC-2025-04 for the full advisory and upgrade guidance.

Workarounds

Disable Nomad audit logging until the patched version is deployed, if operational policies permit
Restrict read access to audit log files and directories to the minimum set of privileged operators
Isolate log-forwarding pipelines so that Nomad audit logs are not co-located with lower-trust log data
Rotate ACL tokens on a shortened schedule to reduce the value of any leaked credentials

bash

# Configuration example: verify Nomad version after upgrade
nomad version

# Rotate a compromised client secret token by bootstrapping a new one
nomad acl token create -name="rotated-client" -type="client" -policy="default"

# Restrict audit log file permissions on the Nomad server
chown nomad:nomad /var/log/nomad/audit.log
chmod 600 /var/log/nomad/audit.log