{"id":"CVE-2026-102260","aliases":[],"cve":{"records":[{"id":"CVE-2026-102260","source":"HashiCorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-28T19:48:07.925Z","published":"2026-10-29T18:05:47.414Z","modified":"2026-10-30T17:18:44.118Z"}],"publishers":[{"name":"HashiCorp","role":"CNA","organizationId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","modified":"2026-10-30T14:03:01.003Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:44.118Z"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-51-nomad-vulnerable-to-cross-namespace-information-disclosure-in-multiple-endpoints/77929","tags":[],"source":"HashiCorp"}],"weaknesses":[{"id":"CWE-863","description":"CWE-863: Incorrect Authorization","source":"HashiCorp"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:18:32.035527Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Nomad vulnerable to cross-namespace information disclosure in multiple endpoints","titleSource":"HashiCorp","descriptionSource":"HashiCorp","description":"HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.","score":4.3,"severity":"medium","published":"2026-10-29T18:05:47.414Z","modified":"2026-10-30T17:18:44.118Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HashiCorp","name":"Nomad","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.11.0","status":"affected","lessThan":"2.1.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-102260"},{"vendor":"HashiCorp","name":"Nomad Enterprise","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.11.0","status":"affected","lessThan":"2.1.0","versionType":"semver","changes":[{"at":"1.11.12","status":"unaffected"},{"at":"1.10.18","status":"unaffected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-102260"}],"remediation":[],"references":["https://discuss.hashicorp.com/t/hcsec-2026-51-nomad-vulnerable-to-cross-namespace-information-disclosure-in-multiple-endpoints/77929"],"sources":[{"name":"CVE","id":"CVE-2026-102260","modified":"2026-10-30T17:18:44.118Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-102260"}],"assessments":[{"source":"HashiCorp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}],"sourceAffected":[],"observedAt":"2026-10-30T17:46:25.895Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T06:30:31.757Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T08:55:35.454Z","attemptedAt":"2026-10-30T08:55:35.454Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T08:55:35.180Z","attemptedAt":"2026-10-30T08:55:35.180Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T08:55:35.718Z","attemptedAt":"2026-10-30T08:55:35.718Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T08:55:34.686Z","attemptedAt":"2026-10-30T08:55:34.686Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-v86q-pc4q-725p","url":"https://github.com/advisories/GHSA-v86q-pc4q-725p","modified":"2026-10-29T18:31:19Z","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T08:55:35.180Z"},{"source":"NVD","id":"CVE-2026-102260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102260","modified":"2026-10-29T18:17:21.160","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T08:55:35.454Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113317","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113317","modified":"Oct 29, 2026, 6:05:47 PM","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T08:55:35.718Z"}],"aiSummary":{"text":"HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace information disclosure, allowing an authenticated user to view information about objects in other namespaces. Affected versions include Nomad before 2.1.1 and Nomad Enterprise before 2.1.0, 1.11.12, and 1.10.18. The weakness is due to incorrect authorization.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T14:56:16.184Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-102260"}]}}