| CVE-2026-119168 |
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration…
|
8.8
High
|
Oct 29, 2026 |
| CVE-2026-107347 |
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes…
|
8.4
High
|
Oct 29, 2026 |
| CVE-2026-102260 |
HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API…
|
4.3
Medium
|
Oct 29, 2026 |
| CVE-2026-14896 |
HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host…
|
4.2
Medium
|
Jul 8, 2026 |
| CVE-2026-14891 |
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job…
|
8.7
High
|
Jul 8, 2026 |
| CVE-2026-14373 |
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's…
|
7.7
High
|
Jul 8, 2026 |
| CVE-2026-7474 |
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path…
|
8.8
High
|
May 12, 2026 |
| CVE-2026-6959 |
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host…
|
6.0
Medium
|
May 12, 2026 |
| CVE-2025-4922 |
Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and…
|
8.1
High
|
Jun 11, 2025 |
| CVE-2025-1296 |
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token…
|
6.5
Medium
|
Mar 10, 2025 |
| CVE-2025-0937 |
Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL…
|
7.1
High
|
Feb 12, 2025 |
| CVE-2024-12678 |
Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace…
|
6.5
Medium
|
Dec 20, 2024 |
| CVE-2024-10975 |
Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume…
|
7.7
High
|
Nov 7, 2024 |
| CVE-2024-7625 |
In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is…
|
5.8
Medium
|
Aug 14, 2024 |
| CVE-2024-6717 |
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to…
|
7.7
High
|
Jul 23, 2024 |
| CVE-2024-1329 |
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file…
|
7.7
High
|
Feb 8, 2024 |
| CVE-2023-3300 |
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI…
|
5.3
Medium
|
Jul 19, 2023 |
| CVE-2023-3072 |
HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates…
|
4.1
Medium
|
Jul 19, 2023 |
| CVE-2023-1782 |
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL…
|
10.0
Critical
|
Apr 5, 2023 |
| CVE-2023-1299 |
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using…
|
7.4
High
|
Mar 14, 2023 |
| CVE-2023-1296 |
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s…
|
2.7
Low
|
Mar 14, 2023 |
| CVE-2023-0821 |
HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza…
|
6.5
Medium
|
Feb 16, 2023 |
| CVE-2022-3867 |
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates…
|
2.7
Low
|
Nov 10, 2022 |
| CVE-2022-3866 |
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths…
|
5.0
Medium
|
Nov 10, 2022 |