Go Package Vulnerabilities
Vulnerabilities associated with github.com/hashicorp/nomad.
Packages
Clear package- github.com/mattermost/mattermost/server/v8199 vulnerabilities
- github.com/mattermost/mattermost-server178 vulnerabilities
- code.gitea.io/gitea94 vulnerabilities
- gogs.io/gogs76 vulnerabilities
- github.com/usememos/memos74 vulnerabilities
- github.com/grafana/grafana61 vulnerabilities
- github.com/rancher/rancher61 vulnerabilities
- github.com/siyuan-note/siyuan/kernel58 vulnerabilities
- github.com/hashicorp/vault55 vulnerabilities
- github.com/traefik/traefik/v253 vulnerabilities
- github.com/traefik/traefik/v352 vulnerabilities
- github.com/mattermost/mattermost-server/v647 vulnerabilities
- github.com/filebrowser/filebrowser/v243 vulnerabilities
- k8s.io/kubernetes43 vulnerabilities
- github.com/zitadel/zitadel41 vulnerabilities
- github.com/argoproj/argo-cd/v237 vulnerabilities
- github.com/cilium/cilium37 vulnerabilities
- github.com/docker/docker36 vulnerabilities
- github.com/answerdev/answer34 vulnerabilities
- github.com/argoproj/argo-cd34 vulnerabilities
- github.com/hashicorp/nomad34 vulnerabilities
- code.vikunja.io/api33 vulnerabilities
- github.com/hashicorp/consul32 vulnerabilities
- github.com/openbao/openbao29 vulnerabilities
- github.com/traefik/traefik29 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-7474HIGH | Nomad vulnerable to path traversal in dynamic host volume which may lead to code executionHashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11. CWE-22May 12, 2026 | CVSS8.8v3.1 | EPSS6.89% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-6959MEDIUM | Nomad vulnerable to arbitrary file read/write on client host through symlink attackHashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11. CWE-59May 12, 2026 | CVSS6.0v3.1 | EPSS0.169% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4922HIGH | Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A JobNomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14. CWE-266Jun 11, 2025 | CVSS8.1v3.1 | EPSS0.501% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-1296MEDIUM | Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit LogsNomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19. CWE-532Mar 10, 2025 | CVSS6.5v3.1 | EPSS0.48% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-12678MEDIUM | Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity TokensNomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16. CWE-266Dec 20, 2024 | CVSS6.5v3.1 | EPSS0.541% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write PermissionNomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. CWE-863Nov 7, 2024 | CVSS-v4.0 | EPSS0.456% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingIn HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability. CWE-610Aug 14, 2024 | CVSS-v4.0 | EPSS0.334% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-6717HIGH | Nomad Vulnerable to Allocation Directory Path Escape Through Archive UnpackingHashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2. CWE-610Jul 23, 2024 | CVSS7.7v3.1 | EPSS0.388% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1329HIGH | Nomad Vulnerable to Arbitrary Write Through Symlink AttackHashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14. | CVSS7.7v3.1 | EPSS0.617% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-3300MEDIUM | Nomad Search API Leaks Information About CSI PluginsHashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1. | CVSS5.3v3.1 | EPSS0.561% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad Caller ACL Token's Secret ID is Exposed to SentinelHashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. | CVSS3.4v3.1 | EPSS0.595% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-3072MEDIUM | Nomad ACL Policies without Label are Applied to Unexpected ResourcesHashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. | CVSS4.1v3.1 | EPSS0.433% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1782CRITICAL | Nomad Unauthenticated Client Agent HTTP Request Privilege EscalationHashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3. | CVSS10.0v3.1 | EPSS0.759% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1299HIGH | Nomad Job Submitter Privilege Escalation Using Workload IdentityHashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1. CWE-862Mar 14, 2023 | CVSS7.4v3.1 | EPSS0.532% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad ACLs Can Not Deny Access to Workload's Own VariablesHashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1. | CVSS2.7v3.1 | EPSS0.54% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-0821MEDIUM | Nomad Client Vulnerable to Decompression Bombs in Artifact BlockHashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4. | CVSS6.5v3.1 | EPSS0.795% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-14802MEDIUM | Hashicorp Nomad Information Exposure Through Environmental VariablesHashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template. | CVSS5.3v3.1 | EPSS0.589% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedHashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2. CWE-613Nov 10, 2022 | CVSS2.7v3.1 | EPSS0.462% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-3866MEDIUM | Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2. CWE-668Nov 10, 2022 | CVSS5.0v3.1 | EPSS0.508% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-41606MEDIUM | Nomad Panics On Job Submission With Bad Artifact Stanza Source URLHashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0. CWE-20Oct 11, 2022 | CVSS6.5v3.1 | EPSS0.763% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-30324CRITICAL | Privilege escalation in Hashicorp NomadHashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1. May 27, 2022 | CVSS9.8v3.1 | EPSS1.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-24685HIGH | HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or ThrottlingHashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6. CWE-770Feb 28, 2022 | CVSS7.5v3.1 | EPSS1.55% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-24683HIGH | Arbitrary file reads in HashiCorp NomadHashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. CWE-22Feb 17, 2022 | CVSS7.5v3.1 | EPSS1.54% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-24684MEDIUM | Nomad Spread Job Stanza May Trigger Panic in ServersHashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6. CWE-400Feb 15, 2022 | CVSS6.5v3.1 | EPSS1.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-24686MEDIUM | HashiCorp Nomad Artifact Download Race ConditionHashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6 CWE-362Feb 14, 2022 | CVSS5.9v3.1 | EPSS0.863% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |