CVE-2024-10975

HIGH

Nomad 1.3.0-1.7.14, 1.8.0-1.9.1 - Unauthorized Cross-Namespace Volume Creation via CSI Write Permission

Title source: llm

Description

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.

References (1)

Core 1

Core References

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission

Scores

CVSS v3 7.7

EPSS 0.0017

EPSS Percentile 37.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (3)

hashicorp/nomad 0Go

hashicorp/nomad 1.3.0 - 1.7.15

hashicorp/nomad 1.3.0 - 1.9.2

Published Nov 07, 2024

Tracked Since Feb 18, 2026