CVEvulnerability

CVE-2021-43415

8.8 HIGH Published 2021-12-03 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2021-12-03
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P

Description

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

Affected configurations

• hashicorp nomad (>= 1.0.0 < 1.0.14) • hashicorp nomad (>= 1.1.0 < 1.1.8) • hashicorp nomad 1.2.0

References

https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288 Mitigation, Vendor Advisory
https://www.hashicorp.com/blog/category/nomad Product, Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288 Mitigation, Vendor Advisory
https://www.hashicorp.com/blog/category/nomad Product, Vendor Advisory