What’s Vulnerable › Vulnerabilities

CVE-2020-28348

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-24 · updated 2026-06-17
• Weakness: CWE-22

Description

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

Affected products

• HashiCorp Nomad Enterprise: from 0.9.0 before 0.10.8; from 0.11.0 before 0.11.7; from 0.12.0 before 0.12.8 — fixed in 0.10.8, 0.11.7, 0.12.8

How to fix

Upgrade to a fixed version: HashiCorp Nomad Enterprise 0.10.8, 0.11.7, 0.12.8. Check the vendor advisory for mitigations.

References

• https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0128-november-10-2020
• https://github.com/hashicorp/nomad/issues/9303
• https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0128-november-10-2020
• https://github.com/hashicorp/nomad/issues/9303

Get alerted when CVE-2020-28348 or the next vulnerability affects your stack