github.com/hashicorp/nomad (Go)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.11.1 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/hashicorp/nomad@v1.11.1 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-hx53-77qj-8663 HashiCorp Nomad vulnerable to a path traversal	High EPSS 8.16%	`< 1.11.0-rc.1.0.20260511152149-cd7240c4099a`	`1.11.0-rc.1.0.20260511152149-cd7240c4099a`
GHSA-hx53-77qj-8663 HashiCorp Nomad vulnerable to a path traversal	High EPSS 8.16%	`< 1.11.0-rc.1.0.20260511152149-cd7240c4099a`	`1.11.0-rc.1.0.20260511152149-cd7240c4099a`
GHSA-3934-423w-4jq3 HashiCorp Nomad vulnerable to symlink attack	Medium EPSS 0.17%	`< 1.11.0-rc.1.0.20260512123500-2a09fd62c238`	`1.11.0-rc.1.0.20260512123500-2a09fd62c238`
GHSA-3934-423w-4jq3 HashiCorp Nomad vulnerable to symlink attack	Medium EPSS 0.17%	`< 1.11.0-rc.1.0.20260512123500-2a09fd62c238`	`1.11.0-rc.1.0.20260512123500-2a09fd62c238`
GHSA-rx97-6c62-55mf Hashicorp Nomad Incorrect Privilege Assignment vulnerability	High EPSS 0.51%	`< 1.10.2`	`1.10.2`
GHSA-rx97-6c62-55mf Hashicorp Nomad Incorrect Privilege Assignment vulnerability	High EPSS 0.51%	`< 1.10.2`	`1.10.2`
GHSA-c3q9-q986-vrwh Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs	Medium EPSS 0.50%	`< 1.9.7`	`1.9.7`
GHSA-c3q9-q986-vrwh Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs	Medium EPSS 0.50%	`<= 1.9.6`	No fix yet
GHSA-hr68-hvgv-xxqf Hashicorp Nomad Incorrect Privilege Assignment vulnerability	Medium EPSS 0.53%	`< 1.9.4`	`1.9.4`
GHSA-hr68-hvgv-xxqf Hashicorp Nomad Incorrect Privilege Assignment vulnerability	Medium EPSS 0.53%	`< 1.9.4`	`1.9.4`
GHSA-2w5v-x29g-jw7j Hashicorp Nomad Incorrect Authorization vulnerability	High EPSS 0.45%	`< 1.9.2`	`1.9.2`
GHSA-2w5v-x29g-jw7j Hashicorp Nomad Incorrect Authorization vulnerability	High EPSS 0.45%	`<= 1.9.1`	No fix yet
GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking	Medium EPSS 0.34%	`>= 0.6.1, < 1.8.3`	`1.8.3`
GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking	Medium EPSS 0.34%	`>= 1.7.0, < 1.7.11`	`1.7.11`
GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking	Medium EPSS 0.34%	`>= 1.8.0, < 1.8.3`	`1.8.3`
GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking	Medium EPSS 0.34%	`>= 0.6.1, < 1.6.14`	`1.6.14`
GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration	High EPSS 0.39%	`< 1.8.2`	`1.8.2`
GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration	High EPSS 0.39%	`< 1.11.1`	`1.11.1`
GHSA-c866-8gpw-p3mv HashiCorp Nomad vulnerable to symlink attacks	High EPSS 0.62%	`>= 1.7.3, < 1.7.4`	`1.7.4`
GHSA-c866-8gpw-p3mv HashiCorp Nomad vulnerable to symlink attacks	High EPSS 0.62%	`>= 1.5.13, < 1.5.14` `>= 1.6.0, < 1.6.7` `>= 1.7.3, < 1.7.4`	`1.5.14` `1.6.7` `1.7.4`
GHSA-c866-8gpw-p3mv HashiCorp Nomad vulnerable to symlink attacks	High EPSS 0.62%	`>= 1.6.0, < 1.6.7`	`1.6.7`
GHSA-c866-8gpw-p3mv HashiCorp Nomad vulnerable to symlink attacks	High EPSS 0.62%	`>= 1.5.13, < 1.5.14`	`1.5.14`
GHSA-v5fm-hr72-27hx Nomad Search API Leaks Information About CSI Plugins	Medium EPSS 0.57%	`>= 1.5.0, < 1.5.7`	`1.5.7`
GHSA-v5fm-hr72-27hx Nomad Search API Leaks Information About CSI Plugins	Medium EPSS 0.57%	`>= 0.11.0, < 1.4.11` `>= 1.5.0, < 1.5.7`	`1.4.11` `1.5.7`
GHSA-v5fm-hr72-27hx Nomad Search API Leaks Information About CSI Plugins	Medium EPSS 0.57%	`>= 0.11.0, < 1.4.11`	`1.4.11`
GHSA-9jfx-84v9-2rr2 Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel	Low EPSS 0.60%	`>= 1.5.0, < 1.5.7`	`1.5.7`
GHSA-9jfx-84v9-2rr2 Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel	Low EPSS 0.60%	`>= 1.2.11, < 1.4.11`	`1.4.11`
GHSA-9jfx-84v9-2rr2 Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel	Low EPSS 0.60%	`>= 1.2.11, < 1.4.11` `>= 1.5.0, < 1.5.7`	`1.4.11` `1.5.7`
GHSA-rpvr-38xv-xvxq Nomad ACL Policies without Label are Applied to Unexpected Resources	Low EPSS 0.44%	`>= 0.7.0, < 1.4.11` `>= 1.5.0, < 1.5.6`	`1.4.11` `1.5.6`
GHSA-rpvr-38xv-xvxq Nomad ACL Policies without Label are Applied to Unexpected Resources	Low EPSS 0.44%	`>= 0.7.0, < 1.4.11`	`1.4.11`
GHSA-rpvr-38xv-xvxq Nomad ACL Policies without Label are Applied to Unexpected Resources	Low EPSS 0.44%	`>= 1.5.0, < 1.5.6`	`1.5.6`
GHSA-f8r8-h93m-mj77 HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation	Critical EPSS 0.77%	`>= 1.5.0, < 1.5.3`	`1.5.3`
GHSA-f8r8-h93m-mj77 HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation	Critical EPSS 0.77%	`>= 1.5.0, < 1.5.3`	`1.5.3`
GHSA-rqm8-q8j9-662f Nomad Job Submitter Privilege Escalation Using Workload Identity	High EPSS 0.53%	`>= 1.5.0, < 1.5.1`	`1.5.1`
GHSA-rqm8-q8j9-662f Nomad Job Submitter Privilege Escalation Using Workload Identity	High EPSS 0.53%	`>= 1.5.0, < 1.5.1`	`1.5.1`
GHSA-hhvx-8755-4cvw Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables	Medium EPSS 0.54%	`>= 1.4.0, < 1.4.6`	`1.4.6`
GHSA-hhvx-8755-4cvw Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables	Medium EPSS 0.54%	`>= 1.4.0, < 1.4.6` `>= 1.5.0, < 1.5.1`	`1.4.6` `1.5.1`
GHSA-hhvx-8755-4cvw Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables	Medium EPSS 0.54%	`>= 1.5.0, < 1.5.1`	`1.5.1`
GHSA-w479-w22g-cffh Uncontrolled Resource Consumption in Hashicorp Nomad	Medium EPSS 0.80%	`>= 1.3.0, < 1.3.9`	`1.3.9`
GHSA-w479-w22g-cffh Uncontrolled Resource Consumption in Hashicorp Nomad	Medium EPSS 0.80%	`>= 1.4.0, < 1.4.4`	`1.4.4`
GHSA-w479-w22g-cffh Uncontrolled Resource Consumption in Hashicorp Nomad	Medium EPSS 0.80%	`>= 1.2.15, < 1.2.16`	`1.2.16`
GHSA-w479-w22g-cffh Uncontrolled Resource Consumption in Hashicorp Nomad	Medium EPSS 0.80%	`>= 1.2.15, < 1.2.16` `>= 1.3.0, < 1.3.9` `>= 1.4.0, < 1.4.4`	`1.2.16` `1.3.9` `1.4.4`
GHSA-9fmc-5fq4-5jwh HashiCorp Nomad vulnerable to Insufficient Session Expiration	Medium EPSS 0.51%	`>= 1.4.0, < 1.4.2`	`1.4.2`
GHSA-9fmc-5fq4-5jwh HashiCorp Nomad vulnerable to Insufficient Session Expiration	Medium EPSS 0.51%	`>= 1.4.0, < 1.4.2`	`1.4.2`
GHSA-7wg4-8m5p-hrfg HashiCorp Nomad vulnerable to non-sensitive metadata exposure	Medium EPSS 0.56%	`>= 1.4.0, < 1.4.2`	`1.4.2`
GHSA-7wg4-8m5p-hrfg HashiCorp Nomad vulnerable to non-sensitive metadata exposure	Medium EPSS 0.56%	`>= 1.4.0, < 1.4.2`	`1.4.2`
GHSA-7v3g-4878-5qrf Nomad Panics On Job Submission With Bad Artifact Stanza Source URL	Medium EPSS 0.87%	`< 1.2.13`	`1.2.13`
GHSA-7v3g-4878-5qrf Nomad Panics On Job Submission With Bad Artifact Stanza Source URL	Medium EPSS 0.87%	`>= 1.3.0, < 1.3.6`	`1.3.6`
GHSA-7v3g-4878-5qrf Nomad Panics On Job Submission With Bad Artifact Stanza Source URL	Medium EPSS 0.87%	`< 1.2.13` `>= 1.3.0, < 1.3.6`	`1.2.13` `1.3.6`
GHSA-526x-rm7j-v389 Privilege escalation in Hashicorp Nomad	Critical EPSS 1.42%	`>= 0.2.0, < 1.1.14`	`1.1.14`
GHSA-526x-rm7j-v389 Privilege escalation in Hashicorp Nomad	Critical EPSS 1.42%	`>= 0.2.0, < 1.1.14` `>= 1.2.0, < 1.2.8` `>= 1.3.0, < 1.3.1`	`1.1.14` `1.2.8` `1.3.1`
GHSA-526x-rm7j-v389 Privilege escalation in Hashicorp Nomad	Critical EPSS 1.42%	`>= 1.3.0, < 1.3.1`	`1.3.1`
GHSA-526x-rm7j-v389 Privilege escalation in Hashicorp Nomad	Critical EPSS 1.42%	`>= 1.2.0, < 1.2.8`	`1.2.8`
GHSA-2w2v-xcr9-mj4m Hashicorp Nomad Access Control Issues	Critical EPSS 2.42%	`>= 0.9.0, < 0.9.2`	`0.9.2`
GHSA-2w2v-xcr9-mj4m Hashicorp Nomad Access Control Issues	Critical EPSS 2.42%	`>= 0.9.0, < 0.9.2`	`0.9.2`
GHSA-3382-r9q8-4hfg HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling	High EPSS 1.55%	`>= 1.1.0, < 1.1.12`	`1.1.12`
GHSA-3382-r9q8-4hfg HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling	High EPSS 1.55%	`>= 1.2.0, < 1.2.6`	`1.2.6`
GHSA-3382-r9q8-4hfg HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling	High EPSS 1.55%	`>= 1.0.0, < 1.0.17` `>= 1.1.0, < 1.1.12` `>= 1.2.0, < 1.2.6`	`1.0.17` `1.1.12` `1.2.6`
GHSA-3382-r9q8-4hfg HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling	High EPSS 1.55%	`>= 1.0.0, < 1.0.17`	`1.0.17`
GHSA-wmrx-57hm-mw7r Arbitrary file reads in HashiCorp Nomad	High EPSS 1.50%	`>= 1.1.0, < 1.1.12`	`1.1.12`
GHSA-wmrx-57hm-mw7r Arbitrary file reads in HashiCorp Nomad	High EPSS 1.50%	`>= 0.9.2, < 1.0.18`	`1.0.18`
GHSA-wmrx-57hm-mw7r Arbitrary file reads in HashiCorp Nomad	High EPSS 1.50%	`>= 1.2.0, < 1.2.6`	`1.2.6`
GHSA-wmrx-57hm-mw7r Arbitrary file reads in HashiCorp Nomad	High EPSS 1.50%	`>= 0.9.2, < 1.0.18` `>= 1.1.0, < 1.1.12` `>= 1.2.0, < 1.2.6`	`1.0.18` `1.1.12` `1.2.6`
GHSA-6jm6-cmcp-fqjq Nomad Spread Job Stanza May Trigger Panic in Servers	Medium EPSS 1.36%	`>= 0.9.0, < 1.0.18`	`1.0.18`
GHSA-6jm6-cmcp-fqjq Nomad Spread Job Stanza May Trigger Panic in Servers	Medium EPSS 1.36%	`>= 0.9.0, < 1.0.18` `>= 1.1.0, < 1.1.12` `>= 1.2.0, < 1.2.6`	`1.0.18` `1.1.12` `1.2.6`
GHSA-6jm6-cmcp-fqjq Nomad Spread Job Stanza May Trigger Panic in Servers	Medium EPSS 1.36%	`>= 1.1.0, < 1.1.12`	`1.1.12`
GHSA-6jm6-cmcp-fqjq Nomad Spread Job Stanza May Trigger Panic in Servers	Medium EPSS 1.36%	`>= 1.2.0, < 1.2.6`	`1.2.6`
GHSA-77cr-6gr8-7rr9 Use After Free in HashiCorp Nomad	Critical EPSS 1.49%	`>= 0.9.0, < 0.10.6` `>= 0.11.0, < 0.11.5` `>= 0.12.0, < 0.12.6`	`0.10.6` `0.11.5` `0.12.6`
GHSA-5x92-p4p5-33c4 Path Traversal in HashiCorp Nomad	Medium EPSS 1.65%	`>= 0.9.0, < 0.10.8` `>= 0.11.0-beta1, < 0.11.7` `>= 0.12.0-beta1, < 0.12.8`	`0.10.8` `0.11.7` `0.12.8`
GHSA-5x92-p4p5-33c4 Path Traversal in HashiCorp Nomad	Medium EPSS 1.65%	`>= 0.12.0-beta1, < 0.12.8`	`0.12.8`
GHSA-5x92-p4p5-33c4 Path Traversal in HashiCorp Nomad	Medium EPSS 1.65%	`>= 0.11.0-beta1, < 0.11.7`	`0.11.7`
GHSA-5x92-p4p5-33c4 Path Traversal in HashiCorp Nomad	Medium EPSS 1.65%	`>= 0.9.0, < 0.10.8`	`0.10.8`
GHSA-77cr-6gr8-7rr9 Use After Free in HashiCorp Nomad	Critical EPSS 1.49%	`>= 0.9.0, < 0.10.6`	`0.10.6`
GHSA-77cr-6gr8-7rr9 Use After Free in HashiCorp Nomad	Critical EPSS 1.49%	`>= 0.11.0, < 0.11.5`	`0.11.5`
GHSA-6hv3-7c34-4hx8 Hashicorp Nomad Information Exposure Through Environmental Variables	Medium EPSS 0.63%	`< 0.9.5`	`0.9.5`
GHSA-77cr-6gr8-7rr9 Use After Free in HashiCorp Nomad	Critical EPSS 1.49%	`>= 0.12.0, < 0.12.6`	`0.12.6`
GHSA-6hv3-7c34-4hx8 Hashicorp Nomad Information Exposure Through Environmental Variables	Medium EPSS 0.63%	`< 0.9.5`	`0.9.5`
GHSA-gwmc-6795-qghj HashiCorp Nomad Artifact Download Race Condition	Medium EPSS 0.86%	`>= 1.2.0, < 1.2.6`	`1.2.6`
GHSA-gwmc-6795-qghj HashiCorp Nomad Artifact Download Race Condition	Medium EPSS 0.86%	`>= 0.3.0, < 1.0.18`	`1.0.18`
GHSA-gwmc-6795-qghj HashiCorp Nomad Artifact Download Race Condition	Medium EPSS 0.86%	`>= 0.3.0, < 1.0.18` `>= 1.1.0, < 1.1.12` `>= 1.2.0, < 1.2.6`	`1.0.18` `1.1.12` `1.2.6`
GHSA-gwmc-6795-qghj HashiCorp Nomad Artifact Download Race Condition	Medium EPSS 0.86%	`>= 1.1.0, < 1.1.12`	`1.1.12`
GHSA-2jhh-5xm2-j4gf Improper Authentication in HashiCorp Nomad	High EPSS 1.22%	`< 1.0.14`	`1.0.14`
GHSA-2jhh-5xm2-j4gf Improper Authentication in HashiCorp Nomad	High EPSS 1.22%	`< 1.0.14` `>= 1.1.0, < 1.1.8` `>= 1.2.0, < 1.2.1`	`1.0.14` `1.1.8` `1.2.1`
GHSA-2jhh-5xm2-j4gf Improper Authentication in HashiCorp Nomad	High EPSS 1.22%	`>= 1.2.0, < 1.2.1`	`1.2.1`
GHSA-2jhh-5xm2-j4gf Improper Authentication in HashiCorp Nomad	High EPSS 1.22%	`>= 1.1.0, < 1.1.8`	`1.1.8`
GHSA-c8x3-rg72-fwwg Privilege escalation in Hashicorp Nomad	High EPSS 0.67%	`>= 1.1.0, < 1.1.4`	`1.1.4`
GHSA-c8x3-rg72-fwwg Privilege escalation in Hashicorp Nomad	High EPSS 0.67%	`< 1.0.10` `>= 1.1.0, < 1.1.4`	`1.0.10` `1.1.4`
GHSA-c8x3-rg72-fwwg Privilege escalation in Hashicorp Nomad	High EPSS 0.67%	`< 1.0.10`	`1.0.10`
GHSA-35qp-xq9f-2rjx Improper Privilege Management in HashiCorp Nomad	High EPSS 1.47%	`< 0.12.10` `>= 1.0.0, < 1.0.3`	`0.12.10` `1.0.3`
GHSA-35qp-xq9f-2rjx Improper Privilege Management in HashiCorp Nomad	High EPSS 1.47%	`< 0.12.10`	`0.12.10`
GHSA-35qp-xq9f-2rjx Improper Privilege Management in HashiCorp Nomad	High EPSS 1.47%	`>= 1.0.0, < 1.0.3`	`1.0.3`
GHSA-vf6q-9f2f-mwhv Improper network isolation in Hashicorp Nomad	Medium EPSS 0.51%	`< 0.12.12`	`0.12.12`
GHSA-vf6q-9f2f-mwhv Improper network isolation in Hashicorp Nomad	Medium EPSS 0.51%	`>= 1.0.0, < 1.0.5`	`1.0.5`
GHSA-vf6q-9f2f-mwhv Improper network isolation in Hashicorp Nomad	Medium EPSS 0.51%	`< 0.12.12` `>= 1.0.0, < 1.0.5`	`0.12.12` `1.0.5`
GHSA-cj2h-ww36-v932 Improper Certificate Validation in HashiCorp Nomad	Critical EPSS 0.98%	`< 0.10.3`	`0.10.3`
GHSA-cj2h-ww36-v932 Improper Certificate Validation in HashiCorp Nomad	Critical EPSS 0.98%	`< 0.10.3`	`0.10.3`
GHSA-h43v-26r7-7j4c Allocation of Resources Without Limits or Throttling in HashiCorp Nomad	High EPSS 1.47%	`< 0.10.3`	`0.10.3`
GHSA-h43v-26r7-7j4c Allocation of Resources Without Limits or Throttling in HashiCorp Nomad	High EPSS 1.47%	`< 0.10.3`	`0.10.3`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor