Read the docs
TI-2022-20009 Aliases CVE-2022-41606GHSA-7v3g-4878-5qrf

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an…

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00867 58th percentileScored 2026-11-07
Fix Fixed github.com/hashicorp/nomad (Go): 1.2.13, 1.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/nomad (Go)before 1.2.131.2.13Patch availableGHSA-7v3g-4878-5qrf
—github.com/hashicorp/nomad (Go)1.3.0 to before 1.3.61.3.6Patch availableGHSA-7v3g-4878-5qrf
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/nomad (Go) Vendor— Affected before 1.2.13 Fixed in 1.2.13 Patch available GHSA-7v3g-4878-5qrf
  • github.com/hashicorp/nomad (Go) Vendor— Affected 1.3.0 to before 1.3.6 Fixed in 1.3.6 Patch available GHSA-7v3g-4878-5qrf

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*1.0.2 to before 1.2.13VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*1.0.2 to before 1.2.13VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*1.3.0 to before 1.3.6VulnerableHashiCorp
cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*1.3.0 to before 1.3.6VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 1.0.2 to before 1.2.13 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 1.0.2 to before 1.2.13 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 1.3.0 to before 1.3.6 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 1.3.0 to before 1.3.6 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-7v3g-4878-5qrf github.com/hashicorp/nomad (Go) Fixed in 1.2.13 Advisory →
  • Fix · GHSA-7v3g-4878-5qrf github.com/hashicorp/nomad (Go) Fixed in 1.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41606
  2. 2026-10-03 Alias added: GHSA-7v3g-4878-5qrf

References

Advisory 3

Other 2

  • TI-2019-09419 HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. CVSS 3.0CRITICAL 9.8
  • TI-2022-12559 HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter… CVSS 3.1CRITICAL 9.8
  • TI-2023-01674 Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation CVSS 3.1CRITICAL 10.0
  • TI-2020-06436 HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region… CVSS 3.1CRITICAL 9.8
  • TI-2020-16532 HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox… CVSS 3.1CRITICAL 9.1
  • TI-2021-19357 HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task… CVSS 3.1HIGH 8.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences