NO
Product
Nomad
44
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 5High 18Medium 19Low 2
Watch
Add Nomad to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-119168 New | 8.8 | Oct 29 | Nomad allocation data migration may allow host directory permission modification via symlink following Affected: 0.5.3 before 2.1.0 |
| CVE-2026-7474 | 8.8 | May 12 | Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution Affected: 1.10.0 before 2.0.1 |
| CVE-2023-1299 | 8.8 | Mar 14 | Nomad Job Submitter Privilege Escalation Using Workload Identity Affected: 1.5.0 |
| CVE-2021-43415 | 8.8 | Dec 3 | HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the… Affected: 1.0.0 before 1.0.14; 1.0.0 before 1.0.14; 1.1.0 before 1.1.8; 1.1.0 before 1.1.8; 1.2.0; 1.2.0 |
| CVE-2021-37218 | 8.8 | Sep 7 | HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege… Affected: before 1.0.10; through 1.0.10; 1.1.1 before 1.1.4; 1.1.1 before 1.1.4 |
| CVE-2026-14891 | 8.7 | Jul 8 | Nomad vulnerable to sandbox escape in Docker task driver Affected: 0.4.1 before 2.0.4 |
| CVE-2024-6717 | 8.6 | Jul 23 | Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking Affected: before 1.8.2 |
| CVE-2026-107347 New | 8.4 | Oct 29 | Nomad dispatch payload writes can escape the allocation directory through symlinks Affected: 0.3.0 before 2.1.0 |
| CVE-2025-4922 | 8.1 | Jun 11 | Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job Affected: 1.4.0 before 1.10.2 |
| CVE-2026-14373 | 7.7 | Jul 8 | Nomad Docker driver Linux host namespace bypass Affected: 0.4.1 before 2.0.4 |
| CVE-2024-10975 | 7.7 | Nov 7 | Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission Affected: 1.3.0 before 1.9.2 |
| CVE-2025-3744 | 7.6 | May 13 | Nomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override Affected: before 1.8.13; 1.9.0 before 1.9.9; 1.10.0; 1.10.0; 1.10.0 |
| CVE-2024-1329 | 7.5 | Feb 8 | Nomad Vulnerable to Arbitrary Write Through Symlink Attack Affected: through 1.5.13; through 1.6.6; through 1.7.3 |
| CVE-2022-24685 | 7.5 | Feb 28 | HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage Affected: 1.0.0 through 1.0.17; 1.0.0 through 1.0.17; 1.1.0 before 1.1.12; 1.1.0 before 1.1.12; 1.2.0 before 1.2.6; 1.2.0 before 1.2.6 |
| CVE-2022-24683 | 7.5 | Feb 17 | HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on… Affected: 0.9.2 before 1.0.18; 0.9.2 before 1.0.18; 1.1.0 before 1.1.12; 1.1.0 before 1.1.12; 1.2.0 before 1.2.6; 1.2.0 before 1.2.6 |
| CVE-2021-3283 | 7.5 | Feb 1 | HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node Affected: before 0.12.10; before 0.12.10; 1.0.0 before 1.0.3; 1.0.0 before 1.0.3 |
| CVE-2020-7218 | 7.5 | Jan 31 | HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service Affected: before 0.10.3; before 0.10.3 |
| CVE-2025-0937 | 7.1 | Feb 12 | Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace Affected: 1.0.0 before 1.9.6 |
Showing 18