Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
Priority LOW 26CWE-610Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed Nomad (HashiCorp): 1.8.3Nomad Enterprise (HashiCorp): 1.8.3+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HashiCorp | Nomad | 0.6.1 to before 1.8.3 | 1.8.3 | Patch available | CNA |
| HashiCorp | Nomad Enterprise | 0.6.1 to before 1.8.3 | 1.8.3 | Patch available | CNA |
| — | github.com/hashicorp/nomad (Go) | 0.6.1 to before 1.6.14 | 1.6.14 | Patch available | GHSA-25qx-vfw2-fw8r |
| — | github.com/hashicorp/nomad (Go) | 1.7.0 to before 1.7.11 | 1.7.11 | Patch available | GHSA-25qx-vfw2-fw8r |
| — | github.com/hashicorp/nomad (Go) | 1.8.0 to before 1.8.3 | 1.8.3 | Patch available | GHSA-25qx-vfw2-fw8r |
- Nomad VendorHashiCorp Affected 0.6.1 to before 1.8.3 Fixed in 1.8.3 Patch available CNA
- Nomad Enterprise VendorHashiCorp Affected 0.6.1 to before 1.8.3 Fixed in 1.8.3 Patch available CNA
- github.com/hashicorp/nomad (Go) Vendor— Affected 0.6.1 to before 1.6.14 Fixed in 1.6.14 Patch available GHSA-25qx-vfw2-fw8r
- github.com/hashicorp/nomad (Go) Vendor— Affected 1.7.0 to before 1.7.11 Fixed in 1.7.11 Patch available GHSA-25qx-vfw2-fw8r
- github.com/hashicorp/nomad (Go) Vendor— Affected 1.8.0 to before 1.8.3 Fixed in 1.8.3 Patch available GHSA-25qx-vfw2-fw8r
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* | 0.6.1 to before 1.6.14 | Vulnerable | HashiCorp |
| cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* | 0.6.1 to before 1.6.14 | Vulnerable | HashiCorp |
| cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* | 1.7.0 to before 1.7.11 | Vulnerable | HashiCorp |
| cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* | 1.7.0 to before 1.7.11 | Vulnerable | HashiCorp |
| cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* | 1.8.0 – 1.8.3 | Vulnerable | HashiCorp |
| cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* | 1.8.0 to before 1.8.3 | Vulnerable | HashiCorp |
- cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 0.6.1 to before 1.6.14 Vulnerable ·HashiCorp
- cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 0.6.1 to before 1.6.14 Vulnerable ·HashiCorp
- cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 1.7.0 to before 1.7.11 Vulnerable ·HashiCorp
- cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 1.7.0 to before 1.7.11 Vulnerable ·HashiCorp
- cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* Versions 1.8.0 – 1.8.3 Vulnerable ·HashiCorp
- cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* Versions 1.8.0 to before 1.8.3 Vulnerable ·HashiCorp
Remediation
- Fix · CNA Nomad (HashiCorp) Fixed in 1.8.3
- Fix · CNA Nomad Enterprise (HashiCorp) Fixed in 1.8.3
- Fix · GHSA-25qx-vfw2-fw8r github.com/hashicorp/nomad (Go) Fixed in 1.6.14 Advisory →
- Fix · GHSA-25qx-vfw2-fw8r github.com/hashicorp/nomad (Go) Fixed in 1.7.11 Advisory →
- Fix · GHSA-25qx-vfw2-fw8r github.com/hashicorp/nomad (Go) Fixed in 1.8.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7625
- 2026-10-03 Alias added: GHSA-25qx-vfw2-fw8r
References
More HashiCorp Nomad vulnerabilities
- TI-2019-09419 HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. CVSS 3.0CRITICAL 9.8
- TI-2022-12559 HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter… CVSS 3.1CRITICAL 9.8
- TI-2023-01674 Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation CVSS 3.1CRITICAL 10.0
- TI-2020-06436 HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region… CVSS 3.1CRITICAL 9.8
- TI-2020-16532 HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox… CVSS 3.1CRITICAL 9.1
- TI-2021-19357 HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task… CVSS 3.1HIGH 8.8
Sources
- CVE-2024-7625 · CVE Program
- CVE-2024-7625 · NVD
- FIRST EPSS
- GHSA-25qx-vfw2-fw8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences