991 matches found
CVE-2025-4922
CVE-2025-4922 affects Nomad Community Edition and Nomad Enterprise where a prefix-based ACL policy lookup can cause incorrect rule application and shadowing. Root cause details are not fully elaborated beyond this behavior in the provided documents, but fixes are specified: Nomad Community Editio...
Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job
Summary Nomad Community and Nomad Enterprise “Nomad” prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14. Background Nomad...
PT-2025-25213
Name of the Vulnerable Software and Affected Versions Hashicorp Nomad versions prior to 1.10.2 Hashicorp Nomad versions prior to 1.9.10 Hashicorp Nomad versions prior to 1.8.14 Description The issue is related to prefix-based ACL policy lookup in Nomad Community and Nomad Enterprise, which can le...
HashiCorp Nomad Enterprise和HashiCorp Nomad Community 安全漏洞
HashiCorp Nomad Enterprise and HashiCorp Nomad Community are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Nomad Enterprise is a professional version of the Nomad software.HashiCorp Nomad Community is HashiCorp Nomad Community is a workload scheduler. A security vulnerability exists in...
The vulnerability of Nomad application orchestrators, related to the disclosure of information through registration files, allows attackers to gain access to the client’s secret token.
The vulnerability of Nomad application orchestrators is related to the disclosure of information through registration files. Exploiting this vulnerability can allow a remote attacker to gain access to the client’s secret token...
Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub
Cybersecurity researchers have discovered a new cryptojacking campaign that's targeting publicly accessible DevOps web servers such as those associated with Docker, Gitea, and HashiCorp Consul and Nomad to illicitly mine cryptocurrencies. Cloud security firm Wiz, which is tracking the activity...
The vulnerability of Nomad application orchestrators, related to the lack of authorization, allows attackers to gain unauthorized access to protected information.
The vulnerability of Nomad application orchestrators is related to the lack of authentication. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of Nomad application orchestrators, related to incorrect input data validation, allows attackers to trigger service failures.
The vulnerability of Nomad application orchestrators is related to improper validation of input data. Exploiting this vulnerability can allow an attacker who operates remotely to cause service failures...
The vulnerability of Nomad application orchestrators, related to the lack of authorization, allows attackers to gain unauthorized access to protected information.
The vulnerability of Nomad application orchestrators is related to the lack of authentication. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of Nomad application orchestrators, related to incorrect processing of network packet headers, allows attackers to escalate their privileges.
The vulnerability of Nomad application orchestrators is related to incorrect processing of network packet headers. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...
The vulnerability of Nomad application orchestrators, related to the disclosure of information in erroneous data areas, allows attackers to gain unauthorized access to protected information.
The vulnerability of Nomad application orchestrators is related to the disclosure of information in erroneous data fields. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of Nomad application developers, related to errors in processing hypertext links, allows attackers to compromise the integrity of the protected information.
The vulnerability of Nomad application developers is related to errors in processing hypertext links. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...
ROS-20250526-04
Vulnerability in Nomad application orchestrator due to ACL policies not using security labels. security labels. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive data...
ROS-20250526-03
Nomad application orchestrator vulnerability related to vulnerability to directory path escaping Distributions. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive data...
CVE-2024-7625
In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability,...
CVE-2023-3300
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...
CVE-2023-1782
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3...
CVE-2023-1299
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1...