CVE-2025-3744: Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies

High severity · published May 13, 2025

CVE-2025-3744

Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies

7.6

CVSS

0.3%

EPSS

On KEV

Description

Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

High

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 22% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Nomad · Hashicorp

before 1.8.13; 1.9.0 before 1.9.9; 1.10.0; 1.10.0; 1.10.0 · source: NVD

Affected product

Nomad

Hashicorp

All Nomad CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-3744

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-3744

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2025-08-nomad-enterprise-vulnerable-to-violation-of-mandatory-sentinel-policies-in-job-submissions-via-policy-override/74935