Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
32 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/hashicorp/nomad < 1.11.0-rc.1.0.20260512123500-2a09fd62c238
Fixed in
1.11.0-rc.1.0.20260512123500-2a09fd62c238· Vendor fix available
Issue
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Recommended action: Upgrade to 1.11.0-rc.1.0.20260512123500-2a09fd62c238 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad < 1.11.0-rc.1.0.20260511152149-cd7240c4099a
Fixed in
1.11.0-rc.1.0.20260511152149-cd7240c4099a· Vendor fix available
Issue
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Recommended action: Upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.
Recommended action: Upgrade to 1.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.
Recommended action: Upgrade to 1.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.
Recommended action: Upgrade to 1.8.3, 1.7.11 or 1.6.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.
Recommended action: Upgrade to 1.7.4, 1.6.7 or 1.5.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad >= 0.11.0, < 1.4.11; >= 1.5.0, < 1.5.7
Fixed in
1.5.71.4.11· Vendor fix available
Issue
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Recommended action: Upgrade to 1.5.7 or 1.4.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad >= 1.2.11, < 1.4.11; >= 1.5.0, < 1.5.7
Fixed in
1.5.71.4.11· Vendor fix available
Issue
A vulnerability was identified in Nomad such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Recommended action: Upgrade to 1.5.7 or 1.4.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad >= 0.7.0, < 1.4.11; >= 1.5.0, < 1.5.6
Fixed in
1.5.61.4.11· Vendor fix available
Issue
A vulnerability was identified in Nomad, an ACL policy using a block without label may be applied to unexpected resources. This vulnerability, CVE-2023-3072, affects Nomad from 0.7 up to 1.5.6 and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Recommended action: Upgrade to 1.5.6 or 1.4.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad >= 1.4.0, < 1.4.6; >= 1.5.0, <= 1.5.0
Fixed in
1.4.61.5.1· Vendor fix available
Issue
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.
Recommended action: Upgrade to 1.5.1 or 1.4.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
Recommended action: Upgrade to 1.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a user with the submit-job ACL capability can submit a job that can escalate to management-level privileges. This vulnerability, CVE-2023-1299, was introduced in Nomad 1.5.0 and fixed in Nomad 1.5.1. Background Nomad 1.4.0 introduced the concept of workload identity so that tasks can access variables without needing to access them through Nomad HTTP API with an ACL token. In 1.5.0, the identity block was introduced, which exposes the workload identity token to the workload so it can access Nomad HTTP API via a unix domain socket without configuring mTLS. Details During internal testing, we discovered it was possible to abuse the workload identity to elevate to management-level privilege if the workload identity did not have any attached ACL policies. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.5.1 or newer. See Nomad’s Upgrading for…
Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.
Recommended action: Upgrade to 1.4.4, 1.3.9 or 1.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.
Recommended action: Upgrade to 1.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.
Recommended action: Upgrade to 1.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad < 1.2.13; >= 1.3.0, < 1.3.6
Fixed in
1.2.131.3.6· Vendor fix available
Issue
HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.
Recommended action: Upgrade to 1.3.6 or 1.2.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.
Recommended action: Upgrade to 1.3.1, 1.2.8 or 1.1.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.
Recommended action: Upgrade to 0.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 is vulnerable to Allocation of Resources Without Limits or Throttling.
Recommended action: Upgrade to 1.2.6, 1.1.12 or 1.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. There are currently no known workarounds. Users are recommended to upgrade as soon as possible to avoid this issue.
Recommended action: Upgrade to 1.2.6, 1.1.12 or 1.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nomad and Nomad Enterprise allows operators with job-submit capabilities to use the spread stanza in a way such that it can cause panic in Nomad servers. This vulnerability, CVE-2022-24684, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6.
Recommended action: Upgrade to 1.2.6, 1.1.12 or 1.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
Recommended action: Upgrade to 0.12.6, 0.11.5 or 0.10.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature (github.com/hashicorp/nomad/drivers/docker) may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
Recommended action: Upgrade to 0.12.8, 0.11.7 or 0.10.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task. As a fix, only task environment variables are used.
Recommended action: Upgrade to 0.9.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.