HashiCorp Vulnerabilities and Affected Products
Vulnerabilities associated with Nomad.
Products
Clear product- Vault Enterprise44 vulnerabilities
- Vault39 vulnerabilities
- Nomad Enterprise23 vulnerabilities
- Nomad21 vulnerabilities
- Consul20 vulnerabilities
- Consul Enterprise19 vulnerabilities
- Tooling11 vulnerabilities
- Shared library8 vulnerabilities
- Boundary4 vulnerabilities
- vault_enterprise4 vulnerabilities
- Boundary Enterprise3 vulnerabilities
- Terraform Enterprise3 vulnerabilities
- go-getter2 vulnerabilities
- Vagrant2 vulnerabilities
- boundary_enterprise1 vulnerability
- shared_library1 vulnerability
- Terraform1 vulnerability
- vault_community_edition1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-14896MEDIUM | Nomad vulnerable to cross-namespace host volume claim deletionHashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. CWE-863Jul 8, 2026 | CVSS4.2v3.1 | EPSS0.16% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-14891HIGH | Nomad vulnerable to sandbox escape in Docker task driverHashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. CWE-59Jul 8, 2026 | CVSS8.7v3.1 | EPSS0.317% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-14373HIGH | Nomad Docker driver Linux host namespace bypassHashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. CWE-862Jul 8, 2026 | CVSS7.7v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-7474HIGH | Nomad vulnerable to path traversal in dynamic host volume which may lead to code executionHashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11. CWE-22May 12, 2026 | CVSS8.8v3.1 | EPSS6.89% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-6959MEDIUM | Nomad vulnerable to arbitrary file read/write on client host through symlink attackHashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11. CWE-59May 12, 2026 | CVSS6.0v3.1 | EPSS0.169% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4922HIGH | Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A JobNomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14. CWE-266Jun 11, 2025 | CVSS8.1v3.1 | EPSS0.501% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-1296MEDIUM | Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit LogsNomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19. CWE-532Mar 10, 2025 | CVSS6.5v3.1 | EPSS0.48% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0937HIGH | Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard NamespaceNomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. CWE-863Feb 12, 2025 | CVSS7.1v3.1 | EPSS0.43% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-12678MEDIUM | Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity TokensNomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16. CWE-266Dec 20, 2024 | CVSS6.5v3.1 | EPSS0.541% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write PermissionNomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. CWE-863Nov 7, 2024 | CVSS-v4.0 | EPSS0.456% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingIn HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability. CWE-610Aug 14, 2024 | CVSS-v4.0 | EPSS0.334% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-6717HIGH | Nomad Vulnerable to Allocation Directory Path Escape Through Archive UnpackingHashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2. CWE-610Jul 23, 2024 | CVSS7.7v3.1 | EPSS0.388% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1329HIGH | Nomad Vulnerable to Arbitrary Write Through Symlink AttackHashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14. | CVSS7.7v3.1 | EPSS0.617% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-3300MEDIUM | Nomad Search API Leaks Information About CSI PluginsHashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1. | CVSS5.3v3.1 | EPSS0.561% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-3072MEDIUM | Nomad ACL Policies without Label are Applied to Unexpected ResourcesHashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. | CVSS4.1v3.1 | EPSS0.433% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1782CRITICAL | Nomad Unauthenticated Client Agent HTTP Request Privilege EscalationHashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3. | CVSS10.0v3.1 | EPSS0.759% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1299HIGH | Nomad Job Submitter Privilege Escalation Using Workload IdentityHashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1. CWE-862Mar 14, 2023 | CVSS7.4v3.1 | EPSS0.532% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad ACLs Can Not Deny Access to Workload's Own VariablesHashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1. | CVSS2.7v3.1 | EPSS0.54% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-0821MEDIUM | Nomad Client Vulnerable to Decompression Bombs in Artifact BlockHashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4. | CVSS6.5v3.1 | EPSS0.795% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedHashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2. CWE-613Nov 10, 2022 | CVSS2.7v3.1 | EPSS0.462% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-3866MEDIUM | Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2. CWE-668Nov 10, 2022 | CVSS5.0v3.1 | EPSS0.508% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |