What’s Vulnerable › Products

HashiCorp Nomad Enterprise vulnerabilities

41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your HashiCorp Nomad Enterprise version is affected

Latest HashiCorp Nomad Enterprise vulnerabilities

• CVE-2026-14896 — Nomad vulnerable to cross-namespace host volume claim deletion (CVSS 4.2)
• CVE-2026-14891 — Nomad vulnerable to sandbox escape in Docker task driver (CVSS 8.7)
• CVE-2026-14373 — Nomad Docker driver Linux host namespace bypass (CVSS 7.7)
• CVE-2026-7474 — Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution (CVSS 8.8)
• CVE-2026-6959 — Nomad vulnerable to arbitrary file read/write on client host through symlink attack (CVSS 6.0)
• CVE-2025-4922 — Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job (CVSS 8.1)
• CVE-2025-3744 — Nomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override (CVSS 7.6)
• CVE-2025-1296 — Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs (CVSS 6.5)
• CVE-2025-0937 — Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace (CVSS 7.1)
• CVE-2024-12678 — Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens (CVSS 6.5)
• CVE-2024-10975 — Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission (CVSS 7.7)
• CVE-2024-7625 — Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking (CVSS 5.8)
• CVE-2024-6717 — Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking (CVSS 8.6)
• CVE-2024-1329 — Nomad Vulnerable to Arbitrary Write Through Symlink Attack (CVSS 7.5)
• CVE-2023-3300 — Nomad Search API Leaks Information About CSI Plugins (CVSS 5.3)
• CVE-2023-3299 — Nomad Caller ACL Token's Secret ID is Exposed to Sentinel (CVSS 2.7)
• CVE-2023-3072 — Nomad ACL Policies without Label are Applied to Unexpected Resources (CVSS 3.8)
• CVE-2023-1782 — Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation (CVSS 9.8)
• CVE-2023-1299 — Nomad Job Submitter Privilege Escalation Using Workload Identity (CVSS 8.8)
• CVE-2023-1296 — Nomad ACLs Can Not Deny Access to Workload's Own Variables (CVSS 5.3)
• CVE-2023-0821 — Nomad Client Vulnerable to Decompression Bombs in Artifact Block (CVSS 6.5)
• CVE-2019-14802 — (CVSS 5.3)
• CVE-2022-3867 — Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected (CVSS 4.3)
• CVE-2022-3866 — Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ (CVSS 4.3)
• CVE-2022-41606 — (CVSS 6.5)