Hashicorp Nomad vulnerabilities

• hashicorp nomad, nomad enterprise +1 more Nomad allocation data migration may allow host directory permission modification via symlink following CVE-2026-119168 8.8 HighOctober 29, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad dispatch payload writes can escape the allocation directory through symlinks CVE-2026-107347 8.4 HighOctober 29, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to cross-namespace information disclosure in multiple endpoints CVE-2026-102260 4.3 MediumOctober 29, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to cross-namespace host volume claim deletion CVE-2026-14896 4.2 MediumJuly 8, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to sandbox escape in Docker task driver CVE-2026-14891 8.7 HighJuly 8, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad Docker driver Linux host namespace bypass CVE-2026-14373 7.7 HighJuly 8, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution CVE-2026-7474 Fix available 8.8 HighMay 12, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to arbitrary file read/write on client host through symlink attack CVE-2026-6959 Fix available 6.0 MediumMay 12, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job CVE-2025-4922 Fix available 8.1 HighJune 11, 2025
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override CVE-2025-3744 7.6 HighMay 13, 2025
• hashicorp nomad, nomad enterprise +1 more Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs CVE-2025-1296 Fix available 6.5 MediumMarch 10, 2025
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace CVE-2025-0937 7.1 HighFebruary 12, 2025
• hashicorp nomad, nomad enterprise +1 more Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens CVE-2024-12678 Fix available 6.5 MediumDecember 20, 2024
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission CVE-2024-10975 Fix available 7.7 HighNovember 7, 2024
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking CVE-2024-7625 Fix available 5.8 MediumAugust 14, 2024
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking CVE-2024-6717 Fix available 7.7 HighJuly 23, 2024
• hashicorp nomad, nomad enterprise +1 more Nomad Vulnerable to Arbitrary Write Through Symlink Attack CVE-2024-1329 Fix available 7.7 HighFebruary 8, 2024
• hashicorp nomad, nomad enterprise +1 more Nomad Search API Leaks Information About CSI Plugins CVE-2023-3300 Fix available 5.3 MediumJuly 19, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad Caller ACL Token's Secret ID is Exposed to Sentinel CVE-2023-3299 Fix available 3.4 LowJuly 19, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad ACL Policies without Label are Applied to Unexpected Resources CVE-2023-3072 Fix available 4.1 MediumJuly 19, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation CVE-2023-1782 Fix available 10.0 CriticalApril 5, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad Job Submitter Privilege Escalation Using Workload Identity CVE-2023-1299 Fix available 7.4 HighMarch 14, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad ACLs Can Not Deny Access to Workload's Own Variables CVE-2023-1296 Fix available 2.7 LowMarch 14, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad Client Vulnerable to Decompression Bombs in Artifact Block CVE-2023-0821 Fix available 6.5 MediumFebruary 16, 2023
• hashicorp nomad, nomad enterprise +1 more Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected CVE-2022-3867 Fix available 2.7 LowNovember 10, 2022
• hashicorp nomad, nomad enterprise +1 more Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ CVE-2022-3866 Fix available 5.0 MediumNovember 10, 2022
• hashicorp nomad Nomad Panics On Job Submission With Bad Artifact Stanza Source URL CVE-2022-41606 Fix available 6.5 MediumOctober 11, 2022
• hashicorp nomad Privilege escalation in Hashicorp Nomad CVE-2022-30324 Fix available 9.8 CriticalMay 27, 2022
• hashicorp nomad HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling CVE-2022-24685 Fix available 7.5 HighFebruary 28, 2022
• hashicorp nomad Arbitrary file reads in HashiCorp Nomad CVE-2022-24683 Fix available 7.5 HighFebruary 17, 2022
• hashicorp nomad Nomad Spread Job Stanza May Trigger Panic in Servers CVE-2022-24684 Fix available 6.5 MediumFebruary 15, 2022
• hashicorp nomad Hashicorp Nomad Information Exposure Through Environmental Variables CVE-2019-14802 Fix available 5.3 MediumFebruary 15, 2022
• hashicorp nomad HashiCorp Nomad Artifact Download Race Condition CVE-2022-24686 Fix available 5.9 MediumFebruary 14, 2022
• hashicorp nomad Improper Authentication in HashiCorp Nomad CVE-2021-43415 Fix available 8.8 HighDecember 3, 2021
• hashicorp nomad HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job... CVE-2021-41865 6.5 MediumOctober 7, 2021
• hashicorp nomad Privilege escalation in Hashicorp Nomad CVE-2021-37218 Fix available 8.8 HighSeptember 7, 2021
• hashicorp nomad Improper network isolation in Hashicorp Nomad CVE-2021-32575 Fix available 6.5 MediumJune 17, 2021
• hashicorp nomad Improper Privilege Management in HashiCorp Nomad CVE-2021-3283 Fix available 7.5 HighFebruary 1, 2021
• hashicorp nomad Path Traversal in HashiCorp Nomad CVE-2020-28348 Fix available 6.5 MediumNovember 24, 2020
• hashicorp nomad Use After Free in HashiCorp Nomad CVE-2020-27195 Fix available 9.1 CriticalOctober 22, 2020
• hashicorp nomad HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fi… CVE-2020-10944 Fix available 5.4 MediumApril 28, 2020
• hashicorp nomad Improper Certificate Validation in HashiCorp Nomad CVE-2020-7956 Fix available 9.8 CriticalJanuary 31, 2020
• hashicorp nomad Allocation of Resources Without Limits or Throttling in HashiCorp Nomad CVE-2020-7218 Fix available 7.5 HighJanuary 31, 2020
• hashicorp nomad Hashicorp Nomad Access Control Issues CVE-2019-12618 Fix available 9.8 CriticalAugust 12, 2019