CVE-2026-102260Medium· 4.3▾ SunlitHashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about object…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Nomad >= 0.11.0 < 2.1.1nomad_enterprise >= 0.11.0 < 2.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119168High· 8.8Nomad allocation data migration may allow host directory permission modification via symlink following
CVE-2026-107347High· 8.4Nomad dispatch payload writes can escape the allocation directory through symlinks
CVE-2026-110720Critical· 9.9Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
CVE-2026-87090High· 8.3Consul vulnerable to an authorization bypass in the catalog node-write path
CVE-2026-87107Medium· 5.4Consul vulnerable to an authorization bypass in the catalog deregistration path
CVE-2025-13432Medium· 4.3Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace