Live › vulnerability › CVE-2026-102260
Nomad and Nomad Enterprise have several read-only API endpoints that skip namespace checks. An authenticated user with read access in one namespace can view objects in other namespaces.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.
Teams that run Nomad or Nomad Enterprise with multiple namespaces and ACLs, where some users hold read permissions in only one namespace. Single-namespace clusters or clusters where every user has full access are less exposed. unknown for other configurations.
No product ranges from the sources yet.
nomad version2.1.02.1.0, 1.11.12, or 1.10.18Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
This page as .md · .json · in your agent: get_signal("CVE-2026-102260")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.