AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-hr68-hvgv-xxqf

Hashicorp Nomad Incorrect Privilege Assignment vulnerability

Nomad

CVE-2024-12678 · Published Dec 20, 2024

Medium6.5
Fix: upgrade to 1.9.4 or later
GitHub advisory

Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
< 1.9.41.9.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266
Also known as
CVE-2024-12678, GO-2024-3354

More Nomad advisories

All Nomad
High 8.1Jun 11, 2025Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2025-4922fixed in 1.10.2Medium 6.5Mar 10, 2025Nomad: secrets in logsCVE-2025-1296no fix yetMedium 7.7Nov 7, 2024Hashicorp Nomad Incorrect Authorization vulnerabilityCVE-2024-10975no fix yetMedium 5.8Aug 15, 2024Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingCVE-2024-7625fixed in 1.6.14 +2High 7.7Jul 23, 2024HashiCorp Nomad is vulnerable to path escape through archive unpacking during migrationCVE-2024-6717fixed in 1.8.2High 7.7Feb 8, 2024HashiCorp Nomad vulnerable to symlink attacksCVE-2024-1329fixed in 1.5.14 +2