Approved changes feed: RSS · Atom
cpe:2.3:a:hashicorp:nomad:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hashicorp (dc524c16-6a01-528e-a41c-9d3e02e5e4a3) |
|---|---|
| Product | Nomad (a46c08bf-7a98-575f-8bcd-ce3372ba85ca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/nomad |
purl2cpe | 2026-06-01 10:14:56.993655 |
pkg:deb/ubuntu/nomad |
purl2cpe | 2026-06-01 10:14:56.993657 |
pkg:github/hashicorp/nomad |
purl2cpe | 2026-06-01 10:14:56.993658 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14896 |
vulnerable | 2026-07-29 00:26:17.641107 |
Nomad vulnerable to cross-namespace host volume claim deletion
MEDIUM (4.2)
HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Published: 2026-07-08T20:21:16.463Z
Updated: 2026-07-09T13:40:15.017Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14891 |
vulnerable | 2026-07-29 00:26:17.634864 |
Nomad vulnerable to sandbox escape in Docker task driver
HIGH (8.7)
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Published: 2026-07-08T20:09:05.752Z
Updated: 2026-07-09T03:55:54.984Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14373 |
vulnerable | 2026-07-29 00:26:16.968864 |
Nomad Docker driver Linux host namespace bypass
HIGH (7.7)
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Published: 2026-07-08T17:29:30.614Z
Updated: 2026-07-08T20:37:39.961Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7474 |
vulnerable | 2026-06-08 08:08:57.284300 |
Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
HIGH (8.8)
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Published: 2026-05-12T19:09:44.680Z
Updated: 2026-05-13T03:58:40.530Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-6959 |
vulnerable | 2026-06-08 08:07:05.203366 |
Nomad vulnerable to arbitrary file read/write on client host through symlink attack
MEDIUM (6)
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Published: 2026-05-12T18:59:09.029Z
Updated: 2026-05-12T20:16:15.200Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4922 |
vulnerable | 2026-06-08 07:29:17.511531 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1296 |
vulnerable | 2026-06-08 07:08:36.275788 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0937 |
vulnerable | 2026-06-08 07:02:26.006948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7625 |
vulnerable | 2026-06-08 06:58:22.877319 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6717 |
vulnerable | 2026-06-08 06:58:20.240510 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1329 |
vulnerable | 2026-06-08 06:25:39.826796 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12678 |
vulnerable | 2026-06-08 06:25:35.888029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10975 |
vulnerable | 2026-06-08 06:23:48.319098 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3300 |
vulnerable | 2026-06-08 06:09:39.096365 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3072 |
vulnerable | 2026-06-08 06:09:38.431086 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1782 |
vulnerable | 2026-06-08 05:52:37.028739 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1299 |
vulnerable | 2026-06-08 05:52:34.370338 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1296 |
vulnerable | 2026-06-08 05:52:34.347630 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0821 |
vulnerable | 2026-06-08 05:52:32.890902 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3867 |
vulnerable | 2026-06-08 05:48:22.497798 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3866 |
vulnerable | 2026-06-08 05:48:22.493000 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-7956 |
vulnerable | 2026-06-08 05:27:14.562920 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10944 |
vulnerable | 2026-06-08 05:16:36.087727 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12618 |
vulnerable | 2026-06-08 05:12:39.414300 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.