MEDIUM5.8Go
GHSA-25qx-vfw2-fw8r· CVE-2024-7625, GO-2024-3073Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
Modified: 9/25/2024
package
Go/github.com/hashicorp/nomad
pkg:go/github.com/hashicorp/nomad
HIGH8.8Go
GHSA-2jhh-5xm2-j4gf· CVE-2021-43415, GO-2022-0573Improper Authentication in HashiCorp Nomad
Modified: 8/21/2024
CRITICAL9.8Go
GHSA-2w2v-xcr9-mj4m· CVE-2019-12618, GO-2023-1928Hashicorp Nomad Access Control Issues
Modified: 8/20/2024
HIGH7.7Go
GHSA-2w5v-x29g-jw7j· CVE-2024-10975, GO-2024-3262Hashicorp Nomad Incorrect Authorization vulnerability
Modified: 11/8/2024
HIGH7.5Go
GHSA-3382-r9q8-4hfg· CVE-2022-24685, GO-2022-0577HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling
Modified: 8/21/2024
HIGH7.5Go
GHSA-35qp-xq9f-2rjx· CVE-2021-3283, GO-2022-0622Improper Privilege Management in HashiCorp Nomad
Modified: 8/21/2024
MEDIUM6.0Go
GHSA-3934-423w-4jq3· CVE-2026-6959, GO-2026-5076HashiCorp Nomad vulnerable to symlink attack
Modified: 6/25/2026
CRITICAL9.8Go
GHSA-526x-rm7j-v389· CVE-2022-30324, GO-2022-0732Privilege escalation in Hashicorp Nomad
Modified: 8/21/2024
HIGH7.7Go
GHSA-5mqx-rpxv-mvxj· CVE-2024-6717, GO-2026-4278HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration
Modified: 2/4/2026
MEDIUM6.5Go
GHSA-5x92-p4p5-33c4· CVE-2020-28348, GO-2022-0770Path Traversal in HashiCorp Nomad
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-6hv3-7c34-4hx8· CVE-2019-14802, GO-2022-0634Hashicorp Nomad Information Exposure Through Environmental Variables
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-6jm6-cmcp-fqjq· CVE-2022-24684, GO-2022-0560Nomad Spread Job Stanza May Trigger Panic in Servers
Modified: 8/21/2024
CRITICAL9.1Go
GHSA-77cr-6gr8-7rr9· CVE-2020-27195, GO-2022-0806Use After Free in HashiCorp Nomad
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-7v3g-4878-5qrf· CVE-2022-41606, GO-2022-1062Nomad Panics On Job Submission With Bad Artifact Stanza Source URL
Modified: 5/20/2025
MEDIUM5.0Go
GHSA-7wg4-8m5p-hrfg· CVE-2022-3866, GO-2022-1105HashiCorp Nomad vulnerable to non-sensitive metadata exposure
Modified: 8/21/2024
LOW2.7Go
GHSA-9fmc-5fq4-5jwh· CVE-2022-3867, GO-2022-1106HashiCorp Nomad vulnerable to Insufficient Session Expiration
Modified: 8/21/2024
LOW3.4Go
GHSA-9jfx-84v9-2rr2· CVE-2023-3299, GO-2024-2669Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel
Modified: 9/26/2024
MEDIUM6.5Go
GHSA-c3q9-q986-vrwh· CVE-2025-1296, GO-2025-3510Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs
Modified: 3/14/2025
HIGH7.7Go
GHSA-c866-8gpw-p3mv· CVE-2024-1329, GO-2024-2538HashiCorp Nomad vulnerable to symlink attacks
Modified: 9/26/2024
HIGH8.8Go
GHSA-c8x3-rg72-fwwg· CVE-2021-37218, GO-2022-0591Privilege escalation in Hashicorp Nomad
Modified: 8/21/2024
CRITICAL9.8Go
GHSA-cj2h-ww36-v932· CVE-2020-7956, GO-2022-0821Improper Certificate Validation in HashiCorp Nomad
Modified: 8/21/2024
HIGH8.8Go
GHSA-f8r8-h93m-mj77· CVE-2023-1782, GO-2023-1707HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation
Modified: 8/20/2024
MEDIUM5.9Go
GHSA-gwmc-6795-qghj· CVE-2022-24686, GO-2022-0600HashiCorp Nomad Artifact Download Race Condition
Modified: 8/21/2024
HIGH7.5Go
GHSA-h43v-26r7-7j4c· CVE-2020-7218, GO-2022-0840Allocation of Resources Without Limits or Throttling in HashiCorp Nomad
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-hhvx-8755-4cvw· CVE-2023-1296, GO-2023-1899Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables
Modified: 8/20/2024
MEDIUM6.5Go
GHSA-hr68-hvgv-xxqf· CVE-2024-12678, GO-2024-3354Hashicorp Nomad Incorrect Privilege Assignment vulnerability
Modified: 12/20/2024
HIGH8.8Go
GHSA-hx53-77qj-8663· CVE-2026-7474, GO-2026-5445HashiCorp Nomad vulnerable to a path traversal
Modified: 6/25/2026
MEDIUM4.1Go
GHSA-rpvr-38xv-xvxq· CVE-2023-3072, GO-2024-2670Nomad ACL Policies without Label are Applied to Unexpected Resources
Modified: 9/26/2024
HIGH8.8Go
GHSA-rqm8-q8j9-662f· CVE-2023-1299, GO-2023-1633Nomad Job Submitter Privilege Escalation Using Workload Identity
Modified: 8/20/2024
HIGH8.1Go
GHSA-rx97-6c62-55mf· CVE-2025-4922, GO-2025-3758Hashicorp Nomad Incorrect Privilege Assignment vulnerability
Modified: 7/28/2025
MEDIUM5.3Go
GHSA-v5fm-hr72-27hx· CVE-2023-3300, GO-2024-2671Nomad Search API Leaks Information About CSI Plugins
Modified: 4/5/2024
MEDIUM6.5Go
GHSA-vf6q-9f2f-mwhv· CVE-2021-32575, GO-2022-0709Improper network isolation in Hashicorp Nomad
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-w479-w22g-cffh· CVE-2023-0821, GO-2023-1581Uncontrolled Resource Consumption in Hashicorp Nomad
Modified: 8/20/2024
HIGH7.5Go
GHSA-wmrx-57hm-mw7r· CVE-2022-24683, GO-2022-0584Arbitrary file reads in HashiCorp Nomad
Modified: 8/21/2024
—Go
GO-2022-0560· CVE-2022-24684, GHSA-6jm6-cmcp-fqjqNomad Spread Job Stanza May Trigger Panic in Servers in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0573· CVE-2021-43415, GHSA-2jhh-5xm2-j4gfImproper Authentication in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0577· CVE-2022-24685, GHSA-3382-r9q8-4hfgHashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0584· CVE-2022-24683, GHSA-wmrx-57hm-mw7rArbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0591· CVE-2021-37218, GHSA-c8x3-rg72-fwwgPrivilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0600· CVE-2022-24686, GHSA-gwmc-6795-qghjHashiCorp Nomad Artifact Download Race Condition in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0622· CVE-2021-3283, GHSA-35qp-xq9f-2rjxImproper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0634· CVE-2019-14802, GHSA-6hv3-7c34-4hx8Hashicorp Nomad Information Exposure Through Environmental Variables in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0709· CVE-2021-32575, GHSA-vf6q-9f2f-mwhvImproper network isolation in Hashicorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0732· CVE-2022-30324, GHSA-526x-rm7j-v389Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0770· CVE-2020-28348, GHSA-5x92-p4p5-33c4Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0806· CVE-2020-27195, GHSA-77cr-6gr8-7rr9Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0821· CVE-2020-7956, GHSA-cj2h-ww36-v932Improper Certificate Validation in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-0840· CVE-2020-7218, GHSA-h43v-26r7-7j4cAllocation of Resources Without Limits or Throttling in HashiCorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-1062· CVE-2022-41606, GHSA-7v3g-4878-5qrfNomad Panics On Job Submission With Bad Artifact Stanza Source URL in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-1105· CVE-2022-3866, GHSA-7wg4-8m5p-hrfgHashiCorp Nomad vulnerable to non-sensitive metadata exposure in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2022-1106· CVE-2022-3867, GHSA-9fmc-5fq4-5jwhHashiCorp Nomad vulnerable to Insufficient Session Expiration in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2023-1581· CVE-2023-0821, GHSA-w479-w22g-cffhUncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2023-1633· CVE-2023-1299, GHSA-rqm8-q8j9-662fNomad Job Submitter Privilege Escalation Using Workload Identity in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2023-1707· CVE-2023-1782, GHSA-f8r8-h93m-mj77HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2023-1899· CVE-2023-1296, GHSA-hhvx-8755-4cvwHashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2023-1928· CVE-2019-12618, GHSA-2w2v-xcr9-mj4mHashicorp Nomad Access Control Issues in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2024-2538· CVE-2024-1329, GHSA-c866-8gpw-p3mvSymlink attack in github.com/hashicorp/nomad
Modified: 5/20/2024
—Go
GO-2024-2669· CVE-2023-3299, GHSA-9jfx-84v9-2rr2API token secret ID leak to Sentinel in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2024-2670· CVE-2023-3072, GHSA-rpvr-38xv-xvxqACL security vulnerability in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2024-2671· CVE-2023-3300, GHSA-v5fm-hr72-27hxCSI plugin names disclosure in github.com/hashicorp/nomad
Modified: 5/20/2024
—Go
GO-2024-3073· CVE-2024-7625, GHSA-25qx-vfw2-fw8rNomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking in github.com/hashicorp/nomad
Modified: 8/19/2024
—Go
GO-2024-3262· CVE-2024-10975, GHSA-2w5v-x29g-jw7jHashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2024-3354· CVE-2024-12678, GHSA-hr68-hvgv-xxqfHashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2025-3510· CVE-2025-1296, GHSA-c3q9-q986-vrwhUnintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2025-3758· CVE-2025-4922, GHSA-rx97-6c62-55mfHashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2026-4278· CVE-2024-6717, GHSA-5mqx-rpxv-mvxjHashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
Modified: 3/3/2026
—Go
GO-2026-5076· CVE-2026-6959, GHSA-3934-423w-4jq3HashiCorp Nomad vulnerable to symlink attack in github.com/hashicorp/nomad
Modified: 6/25/2026
—Go
GO-2026-5445· CVE-2026-7474, GHSA-hx53-77qj-8663HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad
Modified: 6/25/2026