-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, CVE-2025-4922, describes an issue where Nomad's prefix-based ACL policy lookup could lead to incorrect rule application. The provided commit information, specifically commit 2cc598ef007942c519240e325cde2a47f410ce95, directly addresses this. The commit message states, 'Get ACL policy by job using exact job ID' and explains that the previous prefix-based lookup could result in policies being applied incorrectly. The code change in nomad/state/state_store.go within the ACLPolicyByJob function clearly shows the modification from using "job_prefix" to "job" in the txn.Get call. This confirms that ACLPolicyByJob was the function responsible for the vulnerable behavior. The changelog entry associated with this commit also explicitly mentions fixing a bug where 'workflow identity policies are matched by job ID prefix (CVE-2025-4922)'.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/nomad | go | < 1.10.2 |