My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

BIT-CONSUL-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path , which may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events . The vulnerability is rated CVSS 7.7 (High) with a net...

CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

EUVD-2026-75701

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

Consul-template vulnerable to an information disclosure issue in error handling

Summary The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

jupyterhub-nomad-spawner (>=0.0.0, <=0.1.0) potentially affected by CVE-2026-54338 via jupyterhub (2.3.1)

jupyterhub PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jupyterhub-nomad-spawner =0.0.0, =0.1.0 Source cves: CVE-2026-54338 Source advisory: OSV:PYSEC-2026-3853...

CVE-2026-87993: Insertion of Sensitive Information into Log File

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

jupyterhub-nomad-spawner (>=0.0.0, <=0.1.0) potentially affected by CVE-2026-54338 via jupyterhub (2.3.1)

jupyterhub PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jupyterhub-nomad-spawner =0.0.0, =0.1.0 Source cves: CVE-2026-54338 Source advisory: OSV:GHSA-P43P-WHWX-Q52H...

SUSE CVE-2026-6959

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability CVE-2026-6959 is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11...

SUSE CVE-2026-7474

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability CVE-2026-7474 is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11...

SUSE CVE-2026-8052

HashiCorp Nomad's exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability CVE-2026-8052 is fixed in version 0.1.2 of the exec2 task driver...

Nomad - Exposed Jobs Detection

Nomad jobs were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Nomad jobs were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nomad - Exposed Jobs Detection', 'description': 'Nomad jobs were...

Linux Distros Unpatched Vulnerability : CVE-2026-14891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into ...

Linux Distros Unpatched Vulnerability : CVE-2026-14896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator...

Linux Distros Unpatched Vulnerability : CVE-2026-14373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an...

ROS-20260709-73-0037

The vulnerability of Nomad application orchestrators is related to incorrect restrictions on the path name to the catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the Docker task driver when a job submitter is able to bind-mount a host path into a container despite volume bind mounts being disabled. An attacker can gain unauthorized access to read and write files on the host...