---
id: CVE-2026-102260
title: >-
  Nomad vulnerable to cross-namespace information disclosure in multiple
  endpoints
summary: >-
  HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace
  authorization bypasses in several read-only API endpoints that may allow an
  authenticated user with read permissions in one namespace to view information
  about object…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: HashiCorp
product: Nomad
affected:
  - Nomad >= 0.11.0 < 2.1.1
  - nomad_enterprise >= 0.11.0 < 2.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:18:32.035527Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:44.118Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102260'
references:
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-51-nomad-vulnerable-to-cross-namespace-information-disclosure-in-multiple-endpoints/77929
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.07094
ingestedAt: '2026-11-05T16:24:31.197Z'
---

## Overview

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

## Affected

- `Nomad >= 0.11.0 < 2.1.1`
- `nomad_enterprise >= 0.11.0 < 2.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.