{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Nomad Enterprise","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.9.9","status":"unaffected"},{"at":"1.8.13","status":"unaffected"}],"lessThan":"1.10.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"85007077-1AFD-4B50-8F83-767D69AA5150","versionEndExcluding":"1.8.13","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"8D62688F-1A0B-41AB-93FD-6A4433147F83","versionEndExcluding":"1.9.9","versionStartIncluding":"1.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:1.10.0:-:*:*:enterprise:*:*:*","matchCriteriaId":"3523353D-E99A-4C75-B227-CEF80EE10E7C","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:1.10.0:beta1:*:*:enterprise:*:*:*","matchCriteriaId":"33728AF4-2870-466E-89DB-3188A3EB1597","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:1.10.0:rc1:*:*:enterprise:*:*:*","matchCriteriaId":"3E1B41D7-6487-48BD-A8C0-E6916CF8713D","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13."},{"lang":"es","value":"Los trabajos de Nomad Enterprise (\"Nomad\") que usan la opción de anulación de políticas están omitiendo las políticas centinela obligatorias. Esta vulnerabilidad, identificada como CVE-2025-3744, está corregida en Nomad Enterprise 1.10.1, 1.9.9 y 1.8.13."}],"id":"CVE-2025-3744","lastModified":"2026-06-17T09:20:35.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security@hashicorp.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-13T19:20:47.693891Z","version":"2.0.3"}}]},"published":"2025-05-13T19:15:50.820","references":[{"source":"security@hashicorp.com","tags":["Vendor Advisory"],"url":"https://discuss.hashicorp.com/t/hcsec-2025-08-nomad-enterprise-vulnerable-to-violation-of-mandatory-sentinel-policies-in-job-submissions-via-policy-override/74935"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"}],"source":"security@hashicorp.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}