- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 34 · 1 critical, 6 high, 10 medium, 3 low
- Registry
- pkg.go.dev
Advisories 34
- CVE-2026-7474High 8.8
Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
Affected: fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a.
- CVE-2026-6959Medium 6.0
Nomad vulnerable to arbitrary file read/write on client host through symlink attack
Affected: fixed in 1.11.0-rc.1.0.20260512123500-2a09fd62c238.
- CVE-2025-4922High 8.1
Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job
Affected: fixed in 1.10.2.
- CVE-2025-1296Medium 6.5
Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs
Affected: through 1.9.6; fixed in 1.9.7.
- CVE-2024-12678Medium 6.5
Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens
Affected: fixed in 1.9.4.
- CVE-2024-10975High 7.7
Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission
Affected: fixed in 1.9.2; through 1.9.1.
- CVE-2024-7625Medium 5.8
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
Affected: from 0.6.1, fixed in 1.6.14; from 1.7.0, fixed in 1.7.11; from 1.8.0, fixed in 1.8.3; from 0.6.1, fixed in 1.8.3.
- CVE-2024-6717High 7.7
Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking
Affected: fixed in 1.11.1; fixed in 1.8.2.
- CVE-2024-1329High 7.7
Nomad Vulnerable to Arbitrary Write Through Symlink Attack
Affected: from 1.5.13, fixed in 1.5.14; from 1.6.0, fixed in 1.6.7; from 1.7.3, fixed in 1.7.4; from 1.5.13, fixed in 1.5.14; from 1.6.0, fixed in 1.6.7; from 1.7.3, fixed in 1.7.4.
- CVE-2023-3300Medium 5.3
Nomad Search API Leaks Information About CSI Plugins
Affected: from 0.11.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7; from 0.11.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7.
- CVE-2023-3299Low 3.4
Nomad Caller ACL Token's Secret ID is Exposed to Sentinel
Affected: from 1.2.11, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7; from 1.2.11, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7.
- CVE-2023-3072Medium 4.1
Nomad ACL Policies without Label are Applied to Unexpected Resources
Affected: from 0.7.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.6; from 0.7.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.6.
- CVE-2023-1782Critical 10.0
Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation
Affected: from 1.5.0, fixed in 1.5.3.
- CVE-2023-1299High 7.4
Nomad Job Submitter Privilege Escalation Using Workload Identity
Affected: from 1.5.0, fixed in 1.5.1; from 1.5.0, fixed in 1.5.1.
- CVE-2023-1296Low 2.7
Nomad ACLs Can Not Deny Access to Workload's Own Variables
Affected: from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1; from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1.
Show all 34 advisoriesShow fewer advisories
- CVE-2023-0821Medium 6.5
Nomad Client Vulnerable to Decompression Bombs in Artifact Block
Affected: from 1.2.15, fixed in 1.2.16; from 1.3.0, fixed in 1.3.9; from 1.4.0, fixed in 1.4.4; from 1.2.15, fixed in 1.2.16; from 1.3.0, fixed in 1.3.9; from 1.4.0, fixed in 1.4.4.
- CVE-2019-14802Medium 5.3
HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template…
Affected: fixed in 0.9.5.
- CVE-2022-3867Low 2.7
Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected
Affected: from 1.4.0, fixed in 1.4.2.
- CVE-2022-3866Medium 5.0
Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/
Affected: from 1.4.0, fixed in 1.4.2.
- CVE-2022-41606Medium 6.5
HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can…
Affected: fixed in 1.2.13; from 1.3.0, fixed in 1.3.6; fixed in 1.2.13; from 1.3.0, fixed in 1.3.6.
- CVE-2022-30324Unrated
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation…
Affected: from 0.2.0, fixed in 1.1.14; from 1.2.0, fixed in 1.2.8; from 1.3.0, fixed in 1.3.1; from 0.2.0, fixed in 1.1.14; from 1.2.0, fixed in 1.2.8; from 1.3.0, fixed in 1.3.1.
- CVE-2022-24685Unrated
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive…
Affected: from 1.0.0, fixed in 1.0.17; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 1.0.0, fixed in 1.0.17; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6.
- CVE-2022-24683Unrated
HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit)…
Affected: from 0.9.2, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 0.9.2, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6.
- CVE-2022-24684Unrated
HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the…
Affected: from 0.9.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 0.9.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6.
- CVE-2022-24686Unrated
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such…
Affected: from 0.3.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 0.3.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6.
- CVE-2021-43415Unrated
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with…
Affected: fixed in 1.0.14; from 1.1.0, fixed in 1.1.8; from 1.2.0, fixed in 1.2.1; fixed in 1.0.14; from 1.1.0, fixed in 1.1.8; from 1.2.0, fixed in 1.2.1.
- CVE-2021-37218Unrated
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access…
Affected: fixed in 1.0.10; from 1.1.0, fixed in 1.1.4; fixed in 1.0.10; from 1.1.0, fixed in 1.1.4.
- CVE-2021-32575Unrated
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same…
Affected: fixed in 0.12.12; from 1.0.0, fixed in 1.0.5; from 1.0.0, fixed in 1.0.5; fixed in 0.12.12.
- CVE-2021-3283Unrated
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same…
Affected: fixed in 0.12.10; from 1.0.0, fixed in 1.0.3; from 1.0.0, fixed in 1.0.3; fixed in 0.12.10.
- CVE-2020-28348Unrated
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled…
Affected: from 0.9.0, fixed in 0.10.8; from 0.11.0-beta1, fixed in 0.11.7; from 0.12.0-beta1, fixed in 0.12.8; from 0.9.0, fixed in 0.10.8; from 0.11.0-beta1, fixed in 0.11.7; from 0.12.0-beta1, fixed in 0.12.8.
- CVE-2020-27195Unrated
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or…
Affected: from 0.9.0, fixed in 0.10.6; from 0.11.0, fixed in 0.11.5; from 0.12.0, fixed in 0.12.6; from 0.9.0, fixed in 0.10.6; from 0.11.0, fixed in 0.11.5; from 0.12.0, fixed in 0.12.6.
- CVE-2020-7956Unrated
HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC…
Affected: fixed in 0.10.3.
- CVE-2020-7218Unrated
HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to…
Affected: fixed in 0.10.3.
- CVE-2019-12618Unrated
HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.
Affected: from 0.9.0, fixed in 0.9.2.