Advisoriesby Ibis
Nomad security advisories
34 advisories · 1 critical or high in 12 months · latest May 12
34 advisories
HashiCorp Nomad vulnerable to symlink attackCVE-2026-6959fixed in 1.11.0-rc.1.0.20260512123500-2a09fd62c238HashiCorp Nomad vulnerable to a path traversalCVE-2026-7474fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099aHashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2025-4922fixed in 1.10.2Nomad: secrets in logsCVE-2025-1296no fix yetHashicorp Nomad Incorrect Privilege Assignment vulnerabilityCVE-2024-12678fixed in 1.9.4Hashicorp Nomad Incorrect Authorization vulnerabilityCVE-2024-10975no fix yetNomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingCVE-2024-7625fixed in 1.6.14 +2HashiCorp Nomad is vulnerable to path escape through archive unpacking during migrationCVE-2024-6717fixed in 1.8.2HashiCorp Nomad vulnerable to symlink attacksCVE-2024-1329fixed in 1.5.14 +2Nomad Search API Leaks Information About CSI PluginsCVE-2023-3300fixed in 1.4.11 +1Nomad Caller ACL Token’s Secret ID is Exposed to SentinelCVE-2023-3299fixed in 1.4.11 +1Nomad ACL Policies without Label are Applied to Unexpected ResourcesCVE-2023-3072fixed in 1.4.11 +1Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own VariablesCVE-2023-1296fixed in 1.4.6 +1HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationCVE-2023-1782fixed in 1.5.3Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1Uncontrolled Resource Consumption in Hashicorp NomadCVE-2023-0821fixed in 1.2.16 +2HashiCorp Nomad vulnerable to non-sensitive metadata exposureCVE-2022-3866fixed in 1.4.2HashiCorp Nomad vulnerable to Insufficient Session ExpirationCVE-2022-3867fixed in 1.4.2Nomad Panics On Job Submission With Bad Artifact Stanza Source URLCVE-2022-41606fixed in 1.2.13 +1Privilege escalation in Hashicorp NomadCVE-2022-30324fixed in 1.1.14 +2Hashicorp Nomad Access Control IssuesCVE-2019-12618fixed in 0.9.2HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or ThrottlingCVE-2022-24685fixed in 1.0.17 +2Arbitrary file reads in HashiCorp NomadCVE-2022-24683fixed in 1.0.18 +2Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5Use After Free in HashiCorp NomadCVE-2020-27195fixed in 0.10.6 +2HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2Improper Authentication in HashiCorp NomadCVE-2021-43415fixed in 1.0.14 +2Privilege escalation in Hashicorp NomadCVE-2021-37218fixed in 1.0.10 +1Improper Privilege Management in HashiCorp NomadCVE-2021-3283fixed in 0.12.10 +1Improper network isolation in Hashicorp NomadCVE-2021-32575fixed in 0.12.12 +1Improper Certificate Validation in HashiCorp NomadCVE-2020-7956fixed in 0.10.3Allocation of Resources Without Limits or Throttling in HashiCorp NomadCVE-2020-7218fixed in 0.10.3About Nomad
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. Nomad is easy to operate and scale and has native Consul and Vault integrations.
Packages watched: github.com/hashicorp/nomad (Go).
HashiCorp elsewhere on Ibis: Acquisitions · Paydays · Releases · Repos · TechConf