GHSA-526x-rm7j-v389 CVE-2022-30324 GO-2022-0732

Privilege escalation in Hashicorp Nomad

Critical Go

Severity: 9.8 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 1.42%; Chance of exploitation in the next 30 days. Higher than 72.76% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 1.1.14; Upgrade github.com/hashicorp/nomad to this version or later

Description

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/hashicorp/nomad	`>= 0.2.0, < 1.1.14`	`1.1.14`
github.com/hashicorp/nomad	`>= 1.2.0, < 1.2.8`	`1.2.8`
github.com/hashicorp/nomad	`>= 1.3.0, < 1.3.1`	`1.3.1`
github.com/hashicorp/nomad	`>= 0.2.0, < 1.1.14` `>= 1.2.0, < 1.2.8` `>= 1.3.0, < 1.3.1`	`1.1.14` `1.2.8` `1.3.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/hashicorp/nomad Go → `1.1.14`

go

go get github.com/hashicorp/nomad@v1.1.14 && go mod tidy

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

References

Advisories

Packages

github.com/hashicorp/nomad

Timeline

Jun 2, 2022 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-hx53-77qj-8663 HashiCorp Nomad vulnerable to a path traversal	High	Also affects github.com/hashicorp/nomad
GHSA-3934-423w-4jq3 HashiCorp Nomad vulnerable to symlink attack	Medium	Also affects github.com/hashicorp/nomad
GHSA-rx97-6c62-55mf Hashicorp Nomad Incorrect Privilege Assignment vulnerability	High	Also affects github.com/hashicorp/nomad
GHSA-c3q9-q986-vrwh Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs	Medium	Also affects github.com/hashicorp/nomad
GHSA-hr68-hvgv-xxqf Hashicorp Nomad Incorrect Privilege Assignment vulnerability	Medium	Also affects github.com/hashicorp/nomad
GHSA-2w5v-x29g-jw7j Hashicorp Nomad Incorrect Authorization vulnerability	High	Also affects github.com/hashicorp/nomad
GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking	Medium	Also affects github.com/hashicorp/nomad
GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration	High	Also affects github.com/hashicorp/nomad

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor