What is GHSA-v86q-pc4q-725p?

GHSA-v86q-pc4q-725p is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in...

Which CVE IDs does GHSA-v86q-pc4q-725p cover?

GHSA-v86q-pc4q-725p covers the following CVE IDs: CVE-2026-102260. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v86q-pc4q-725p?

GHSA-v86q-pc4q-725p has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-v86q-pc4q-725pMediumCVSS 4.3

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in...

Vendor

GitHub Security Advisories

Published

October 29, 2026

Last Modified

October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-102260 →

📋 Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-102260
https://discuss.hashicorp.com/t/hcsec-2026-51-nomad-vulnerable-to-cross-namespace-information-disclosure-in-multiple-endpoints/77929
https://github.com/advisories/GHSA-v86q-pc4q-725p