Approved changes feed: RSS · Atom
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*
part: a version: * update: *
| Vendor | Hashicorp (dc524c16-6a01-528e-a41c-9d3e02e5e4a3) |
|---|---|
| Product | Nomad (a46c08bf-7a98-575f-8bcd-ce3372ba85ca) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/nomad |
purl2cpe | 2026-06-01 10:14:57.006822 |
pkg:deb/ubuntu/nomad |
purl2cpe | 2026-06-01 10:14:57.006823 |
pkg:github/hashicorp/nomad |
purl2cpe | 2026-06-01 10:14:57.006825 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-4922 |
vulnerable | 2026-06-08 07:29:17.513889 |
Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job
HIGH (8.1)
Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.
Published: 2025-06-11T13:24:18.976Z
Updated: 2025-06-11T13:53:55.809Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1296 |
vulnerable | 2026-06-08 07:08:36.278994 |
Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs
MEDIUM (6.5)
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Published: 2025-03-10T18:02:21.579Z
Updated: 2025-03-11T20:18:55.186Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0937 |
vulnerable | 2026-06-08 07:02:26.009654 |
Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace
HIGH (7.1)
Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.
Published: 2025-02-12T18:59:25.011Z
Updated: 2025-02-12T19:32:54.537Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7625 |
vulnerable | 2026-06-08 06:58:22.877537 |
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
MEDIUM (5.8)
In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.
Published: 2024-08-14T23:20:17.888Z
Updated: 2025-01-09T19:19:01.219Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6717 |
vulnerable | 2026-06-08 06:58:20.241881 |
Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking
HIGH (7.7)
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
Published: 2024-07-23T00:16:20.955Z
Updated: 2024-08-01T21:41:04.313Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1329 |
vulnerable | 2026-06-08 06:25:39.828255 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10975 |
vulnerable | 2026-06-08 06:23:48.322107 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3300 |
vulnerable | 2026-06-08 06:09:39.096548 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3299 |
vulnerable | 2026-06-08 06:09:39.095893 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3072 |
vulnerable | 2026-06-08 06:09:38.432545 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1782 |
vulnerable | 2026-06-08 05:52:37.028901 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1296 |
vulnerable | 2026-06-08 05:52:34.347789 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0821 |
vulnerable | 2026-06-08 05:52:32.893345 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41606 |
vulnerable | 2026-06-08 05:48:30.599342 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-30324 |
vulnerable | 2026-06-08 05:43:37.951172 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24686 |
vulnerable | 2026-06-08 05:41:01.375620 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24685 |
vulnerable | 2026-06-08 05:41:01.375074 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24684 |
vulnerable | 2026-06-08 05:41:01.374521 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24683 |
vulnerable | 2026-06-08 05:41:01.373460 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43415 |
vulnerable | 2026-06-08 05:36:43.376668 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41865 |
vulnerable | 2026-06-08 05:35:21.210066 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3283 |
vulnerable | 2026-06-08 05:33:51.077046 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37218 |
vulnerable | 2026-06-08 05:32:53.959323 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32575 |
vulnerable | 2026-06-08 05:32:07.464872 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-7218 |
vulnerable | 2026-06-08 05:27:12.620611 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28348 |
vulnerable | 2026-06-08 05:23:54.019851 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-27195 |
vulnerable | 2026-06-08 05:23:52.227741 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14802 |
vulnerable | 2026-06-08 05:12:56.031094 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.