Read the docs
TI-2022-08504 Aliases CVE-2022-24686GHSA-gwmc-6795-qghj

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact…

Priority LOW 28CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6

Why it matters now

EPSS 0.00859 58th percentileScored 2026-11-07
Fix Fixed github.com/hashicorp/nomad (Go): 1.0.18, 1.1.12, 1.2.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/nomad (Go)0.3.0 to before 1.0.181.0.18Patch availableGHSA-gwmc-6795-qghj
—github.com/hashicorp/nomad (Go)1.1.0 to before 1.1.121.1.12Patch availableGHSA-gwmc-6795-qghj
—github.com/hashicorp/nomad (Go)1.2.0 to before 1.2.61.2.6Patch availableGHSA-gwmc-6795-qghj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/nomad (Go) Vendor— Affected 0.3.0 to before 1.0.18 Fixed in 1.0.18 Patch available GHSA-gwmc-6795-qghj
  • github.com/hashicorp/nomad (Go) Vendor— Affected 1.1.0 to before 1.1.12 Fixed in 1.1.12 Patch available GHSA-gwmc-6795-qghj
  • github.com/hashicorp/nomad (Go) Vendor— Affected 1.2.0 to before 1.2.6 Fixed in 1.2.6 Patch available GHSA-gwmc-6795-qghj

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*0.3.0 to before 1.0.18VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*0.3.0 to before 1.0.18VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*1.1.0 to before 1.1.12VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*1.1.0 to before 1.1.12VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*1.2.0 to before 1.2.6VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*1.2.0 to before 1.2.6VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 0.3.0 to before 1.0.18 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 0.3.0 to before 1.0.18 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 1.1.0 to before 1.1.12 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 1.1.0 to before 1.1.12 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 1.2.0 to before 1.2.6 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 1.2.0 to before 1.2.6 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-gwmc-6795-qghj github.com/hashicorp/nomad (Go) Fixed in 1.0.18 Advisory →
  • Fix · GHSA-gwmc-6795-qghj github.com/hashicorp/nomad (Go) Fixed in 1.1.12 Advisory →
  • Fix · GHSA-gwmc-6795-qghj github.com/hashicorp/nomad (Go) Fixed in 1.2.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24686
  2. 2026-10-03 Alias added: GHSA-gwmc-6795-qghj

References

Advisory 4

Other 4

  • TI-2019-09419 HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. CVSS 3.0CRITICAL 9.8
  • TI-2022-12559 HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter… CVSS 3.1CRITICAL 9.8
  • TI-2023-01674 Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation CVSS 3.1CRITICAL 10.0
  • TI-2020-06436 HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region… CVSS 3.1CRITICAL 9.8
  • TI-2020-16532 HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox… CVSS 3.1CRITICAL 9.1
  • TI-2021-19357 HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task… CVSS 3.1HIGH 8.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences