# github.com/hashicorp/nomad (Go) vulnerabilities 34 known vulnerabilities (1 critical, 6 high, 10 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/github.com/hashicorp/nomad ## Advisories (34) ### [CVE-2026-7474](https://cve.now/CVE-2026-7474): Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution - Severity: High 8.8 - Published: May 12, 2026 - Affected: fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a. ### [CVE-2026-6959](https://cve.now/CVE-2026-6959): Nomad vulnerable to arbitrary file read/write on client host through symlink attack - Severity: Medium 6.0 - Published: May 12, 2026 - Affected: fixed in 1.11.0-rc.1.0.20260512123500-2a09fd62c238. ### [CVE-2025-4922](https://cve.now/CVE-2025-4922): Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job - Severity: High 8.1 - Published: Jun 11, 2025 - Affected: fixed in 1.10.2. ### [CVE-2025-1296](https://cve.now/CVE-2025-1296): Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs - Severity: Medium 6.5 - Published: Mar 10, 2025 - Affected: through 1.9.6; fixed in 1.9.7. ### [CVE-2024-12678](https://cve.now/CVE-2024-12678): Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens - Severity: Medium 6.5 - Published: Dec 20, 2024 - Affected: fixed in 1.9.4. ### [CVE-2024-10975](https://cve.now/CVE-2024-10975): Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission - Severity: High 7.7 - Published: Nov 7, 2024 - Affected: fixed in 1.9.2; through 1.9.1. ### [CVE-2024-7625](https://cve.now/CVE-2024-7625): Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking - Severity: Medium 5.8 - Published: Aug 14, 2024 - Affected: from 0.6.1, fixed in 1.6.14; from 1.7.0, fixed in 1.7.11; from 1.8.0, fixed in 1.8.3; from 0.6.1, fixed in 1.8.3. ### [CVE-2024-6717](https://cve.now/CVE-2024-6717): Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking - Severity: High 7.7 - Published: Jul 23, 2024 - Affected: fixed in 1.11.1; fixed in 1.8.2. ### [CVE-2024-1329](https://cve.now/CVE-2024-1329): Nomad Vulnerable to Arbitrary Write Through Symlink Attack - Severity: High 7.7 - Published: Feb 8, 2024 - Affected: from 1.5.13, fixed in 1.5.14; from 1.6.0, fixed in 1.6.7; from 1.7.3, fixed in 1.7.4; from 1.5.13, fixed in 1.5.14; from 1.6.0, fixed in 1.6.7; from 1.7.3, fixed in 1.7.4. ### [CVE-2023-3300](https://cve.now/CVE-2023-3300): Nomad Search API Leaks Information About CSI Plugins - Severity: Medium 5.3 - Published: Jul 19, 2023 - Affected: from 0.11.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7; from 0.11.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7. ### [CVE-2023-3299](https://cve.now/CVE-2023-3299): Nomad Caller ACL Token's Secret ID is Exposed to Sentinel - Severity: Low 3.4 - Published: Jul 19, 2023 - Affected: from 1.2.11, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7; from 1.2.11, fixed in 1.4.11; from 1.5.0, fixed in 1.5.7. ### [CVE-2023-3072](https://cve.now/CVE-2023-3072): Nomad ACL Policies without Label are Applied to Unexpected Resources - Severity: Medium 4.1 - Published: Jul 19, 2023 - Affected: from 0.7.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.6; from 0.7.0, fixed in 1.4.11; from 1.5.0, fixed in 1.5.6. ### [CVE-2023-1782](https://cve.now/CVE-2023-1782): Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation - Severity: Critical 10.0 - Published: Apr 5, 2023 - Affected: from 1.5.0, fixed in 1.5.3. ### [CVE-2023-1299](https://cve.now/CVE-2023-1299): Nomad Job Submitter Privilege Escalation Using Workload Identity - Severity: High 7.4 - Published: Mar 14, 2023 - Affected: from 1.5.0, fixed in 1.5.1; from 1.5.0, fixed in 1.5.1. ### [CVE-2023-1296](https://cve.now/CVE-2023-1296): Nomad ACLs Can Not Deny Access to Workload's Own Variables - Severity: Low 2.7 - Published: Mar 14, 2023 - Affected: from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1; from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1. ### [CVE-2023-0821](https://cve.now/CVE-2023-0821): Nomad Client Vulnerable to Decompression Bombs in Artifact Block - Severity: Medium 6.5 - Published: Feb 16, 2023 - Affected: from 1.2.15, fixed in 1.2.16; from 1.3.0, fixed in 1.3.9; from 1.4.0, fixed in 1.4.4; from 1.2.15, fixed in 1.2.16; from 1.3.0, fixed in 1.3.9; from 1.4.0, fixed in 1.4.4. ### [CVE-2019-14802](https://cve.now/CVE-2019-14802): HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template… - Severity: Medium 5.3 - Published: Dec 26, 2022 - Affected: fixed in 0.9.5. ### [CVE-2022-3867](https://cve.now/CVE-2022-3867): Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected - Severity: Low 2.7 - Published: Nov 10, 2022 - Affected: from 1.4.0, fixed in 1.4.2. ### [CVE-2022-3866](https://cve.now/CVE-2022-3866): Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ - Severity: Medium 5.0 - Published: Nov 10, 2022 - Affected: from 1.4.0, fixed in 1.4.2. ### [CVE-2022-41606](https://cve.now/CVE-2022-41606): HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can… - Severity: Medium 6.5 - Published: Oct 11, 2022 - Affected: fixed in 1.2.13; from 1.3.0, fixed in 1.3.6; fixed in 1.2.13; from 1.3.0, fixed in 1.3.6. ### [CVE-2022-30324](https://cve.now/CVE-2022-30324): HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation… - Severity: Unrated - Published: May 27, 2022 - Affected: from 0.2.0, fixed in 1.1.14; from 1.2.0, fixed in 1.2.8; from 1.3.0, fixed in 1.3.1; from 0.2.0, fixed in 1.1.14; from 1.2.0, fixed in 1.2.8; from 1.3.0, fixed in 1.3.1. ### [CVE-2022-24685](https://cve.now/CVE-2022-24685): HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive… - Severity: Unrated - Published: Feb 28, 2022 - Affected: from 1.0.0, fixed in 1.0.17; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 1.0.0, fixed in 1.0.17; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6. ### [CVE-2022-24683](https://cve.now/CVE-2022-24683): HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit)… - Severity: Unrated - Published: Feb 17, 2022 - Affected: from 0.9.2, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 0.9.2, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6. ### [CVE-2022-24684](https://cve.now/CVE-2022-24684): HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the… - Severity: Unrated - Published: Feb 15, 2022 - Affected: from 0.9.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 0.9.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6. ### [CVE-2022-24686](https://cve.now/CVE-2022-24686): HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such… - Severity: Unrated - Published: Feb 14, 2022 - Affected: from 0.3.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6; from 0.3.0, fixed in 1.0.18; from 1.1.0, fixed in 1.1.12; from 1.2.0, fixed in 1.2.6. ### [CVE-2021-43415](https://cve.now/CVE-2021-43415): HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with… - Severity: Unrated - Published: Dec 3, 2021 - Affected: fixed in 1.0.14; from 1.1.0, fixed in 1.1.8; from 1.2.0, fixed in 1.2.1; fixed in 1.0.14; from 1.1.0, fixed in 1.1.8; from 1.2.0, fixed in 1.2.1. ### [CVE-2021-37218](https://cve.now/CVE-2021-37218): HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access… - Severity: Unrated - Published: Sep 7, 2021 - Affected: fixed in 1.0.10; from 1.1.0, fixed in 1.1.4; fixed in 1.0.10; from 1.1.0, fixed in 1.1.4. ### [CVE-2021-32575](https://cve.now/CVE-2021-32575): HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same… - Severity: Unrated - Published: Jun 17, 2021 - Affected: fixed in 0.12.12; from 1.0.0, fixed in 1.0.5; from 1.0.0, fixed in 1.0.5; fixed in 0.12.12. ### [CVE-2021-3283](https://cve.now/CVE-2021-3283): HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same… - Severity: Unrated - Published: Feb 1, 2021 - Affected: fixed in 0.12.10; from 1.0.0, fixed in 1.0.3; from 1.0.0, fixed in 1.0.3; fixed in 0.12.10. ### [CVE-2020-28348](https://cve.now/CVE-2020-28348): HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled… - Severity: Unrated - Published: Nov 24, 2020 - Affected: from 0.9.0, fixed in 0.10.8; from 0.11.0-beta1, fixed in 0.11.7; from 0.12.0-beta1, fixed in 0.12.8; from 0.9.0, fixed in 0.10.8; from 0.11.0-beta1, fixed in 0.11.7; from 0.12.0-beta1, fixed in 0.12.8. ### [CVE-2020-27195](https://cve.now/CVE-2020-27195): HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or… - Severity: Unrated - Published: Oct 22, 2020 - Affected: from 0.9.0, fixed in 0.10.6; from 0.11.0, fixed in 0.11.5; from 0.12.0, fixed in 0.12.6; from 0.9.0, fixed in 0.10.6; from 0.11.0, fixed in 0.11.5; from 0.12.0, fixed in 0.12.6. ### [CVE-2020-7956](https://cve.now/CVE-2020-7956): HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC… - Severity: Unrated - Published: Jan 31, 2020 - Affected: fixed in 0.10.3. ### [CVE-2020-7218](https://cve.now/CVE-2020-7218): HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to… - Severity: Unrated - Published: Jan 31, 2020 - Affected: fixed in 0.10.3. ### [CVE-2019-12618](https://cve.now/CVE-2019-12618): HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. - Severity: Unrated - Published: Aug 12, 2019 - Affected: from 0.9.0, fixed in 0.9.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/hashicorp/nomad Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.