HCSEC-2026-51 - Nomad vulnerable to cross-namespace information disclosure in multiple endpoints

Bulletin ID: HCSEC-2026-51 Affected Products / Versions: Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, 1.10.18 Publication Date: October 29, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Background Nomad namespaces isolate jobs, volumes, scaling policies, and related objects, and namespaced access control list (ACL) capabilities govern access so that operators can view and manage only objects within namespaces they are authorized for. Nomad also supports queries spanning all namespaces, which are intended to return results only from namespaces the requester is authorized to access. Details Nomad did not consistently verify that objects returned by certain API endpoints belonged to a namespace the requester was authorized for. When querying across all namespaces, the host volume list endpoint and the search endpoints could return objects from unauthorized namespaces, potentially disclosing object identifiers and volume metadata. Separately, reading a scaling policy by its identifier did not verify the namespace of the policy’s target, which could allow a user who already knows the identifier of a scaling policy in another namespace to read its contents. These issues require an authenticated ACL token holding the relevant read capability in at least one namespace, and are limited to information disclosure; they do not allow modifying or operating on objects in other namespaces. Clusters that use only a single namespace are not affected. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Nomad Community Ed…