Vulnerability Report: GO-2025-3510
- CVE-2025-1296, GHSA-c3q9-q986-vrwh
- Affects: github.com/hashicorp/nomad
- Published: Mar 13, 2025
- Modified: Jun 11, 2025
Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
For detailed information about this vulnerability, visit https://github.com/advisories/GHSA-c3q9-q986-vrwh.
Affected Modules
-
PathGo Versions
-
before v1.9.7
Aliases
References
- https://github.com/advisories/GHSA-c3q9-q986-vrwh
- https://github.com/hashicorp/nomad/commit/dc482bf9058faf7a192486eb52caa1d42646f6b3
- https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737
- https://vuln.go.dev/ID/GO-2025-3510.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.