Is CVE-2026-102260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102260 being exploited in the wild.

How severe is CVE-2026-102260?

Medium severity, with a CVSS score of 4.3, published 29 October 2026.

Which products and versions are affected?

HashiCorp Nomad up to 2.0.7; HashiCorp Nomad Enterprise up to 2.0.7.

Is there a fix for CVE-2026-102260?

Yes: fixed in Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, 1.10.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102260 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-102260?

Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102260: HashiCorp Nomad cross-namespace authorization bypass in API endpoints

CVE-2026-102260 · Severity: medium · CVSS 4.3 · Published 2026-10-29

HashiCorp Nomad is a workload orchestration and scheduling platform that manages containerized and non-containerized applications. An authenticated user with read permissions in one namespace can view confidential information about jobs, volumes, and scaling policies in other namespaces through multiple API endpoints, bypassing namespace isolation controls. This disclosure affects only clusters using multiple namespaces and does not permit modification of objects outside the user's authorized namespace.

Technologies: HashiCorp Nomad, HashiCorp Nomad Enterprise. Vendors: HashiCorp.

Quick answers

Is CVE-2026-102260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102260 being exploited in the wild.
How severe is CVE-2026-102260?: Medium severity, with a CVSS score of 4.3, published 29 October 2026.
Which products and versions are affected?: HashiCorp Nomad up to 2.0.7; HashiCorp Nomad Enterprise up to 2.0.7.
Is there a fix for CVE-2026-102260?: Yes: fixed in Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, 1.10.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102260 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-102260?: Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, 1.10.18

Technical details

Multiple read-only API endpoints (host volume list, CSI volume list, search, and scaling policy read) fail to consistently verify that returned objects belong to a namespace the requester is authorized for. An authenticated attacker with ACL read capabilities in at least one namespace can enumerate object identifiers and metadata across unauthorized namespaces via cross-namespace queries. The vulnerability is limited to information disclosure and does not permit object modification or operations.

Affected products

HashiCorp Nomad up to 2.0.7
HashiCorp Nomad Enterprise up to 2.0.7

Timeline

2026-10-29: disclosed

References

https://discuss.hashicorp.com/t/hcsec-2026-51-nomad-vulnerable-to-cross-namespace-information-disclosure-in-multiple-endpoints/77929

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.