CVE-2021-3283
Improper Privilege Management in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
CVE-2021-3283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
CVE-2021-3283- Updated
- 2026-11-02
EUVDEUVD-2021-1249 No score
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
EUVD-2021-1249- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-35qp-xq9f-2rjx
Improper Privilege Management in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
GHSA-35qp-xq9f-2rjx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-3283
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
ALPINE-CVE-2021-3283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
CVE-2021-3283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-35qp-xq9f-2rjx
Improper Privilege Management in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
GHSA-35qp-xq9f-2rjx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3283
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
- Record
UBUNTU-CVE-2021-3283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGO-2022-0622 No score
Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad
Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad
- Record
GO-2022-0622- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hashicorp/nomadGo |
1.0.0 up to 1.0.3 | 1.0.3 |
github.com/hashicorp/nomadGo |
before 0.12.10 | 0.12.10 |
nomadAlpine:v3.13 |
1.0.0 up to 0.12.10-r0 | 0.12.10-r0 |
nomadAlpine:v3.14 |
1.0.0 up to 1.0.4-r0 | 1.0.4-r0 |
nomadAlpine:v3.15 |
1.0.0 up to 1.0.4-r0 | 1.0.4-r0 |
nomadAlpine:v3.16 |
1.0.0 up to 1.0.4-r0 | 1.0.4-r0 |
nomadAlpine:v3.17 |
1.0.0 up to 1.0.4-r0 | 1.0.4-r0 |
nomadAlpine:v3.18 |
1.0.0 up to 1.0.4-r0 | 1.0.4-r0 |
github.com/hashicorp/nomadGo |
before 0.12.10, 1.0.0 up to 1.0.3 | 0.12.101.0.3 |
nomadUbuntu:18.04:LTS |
All versions, plus listed versions 0.4.0+dfsg-1 |
None known |
nomadUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.7+dfsg1-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3283 is a high vulnerability (CVSS 7.5) in Hashicorp Nomad, published February 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in github.com/hashicorp/nomad 1.0.3.