AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-2w5v-x29g-jw7j

Hashicorp Nomad Incorrect Authorization vulnerability

Nomad

CVE-2024-10975 · Published Nov 7, 2024 · updated Nov 8, 2024

Medium7.7
No fix yet
GitHub advisory

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
<= 1.9.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
CVE-2024-10975, GO-2024-3262

More Nomad advisories

All Nomad
High 8.1Jun 11, 2025Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2025-4922fixed in 1.10.2Medium 6.5Mar 10, 2025Nomad: secrets in logsCVE-2025-1296no fix yetMedium 6.5Dec 20, 2024Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2024-12678fixed in 1.9.4Medium 5.8Aug 15, 2024Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingCVE-2024-7625fixed in 1.6.14 +2High 7.7Jul 23, 2024HashiCorp Nomad is vulnerable to path escape through archive unpacking during migrationCVE-2024-6717fixed in 1.8.2High 7.7Feb 8, 2024HashiCorp Nomad vulnerable to symlink attacksCVE-2024-1329fixed in 1.5.14 +2