CVE-2019-14802: Hashicorp Nomad Information Exposure Through Environmental Variables
Summary
CVE-2019-14802: Hashicorp Nomad Information Exposure Through Environmental Variables. Affects github.com/hashicorp/nomad versions < 0.9.5. Fixed in 0.9.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Nomad is an open-source cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a distributed infrastructure. Nomad allows users to define and run tasks using task templates, which can include environment variables. These variables are used to configure and customize the behavior of tasks within the Nomad cluster.
Vulnerability Detail
The vulnerability identified as CVE-2019-14802 in Nomad versions prior to 0.9.5 allows for information exposure through environmental variables. When rendering a task template, all environment variables were accessible to the rendering task, potentially exposing sensitive information. This could lead to unauthorized access, data leakage, or other security breaches. To address this issue, Nomad has been updated to only use task environment variables during the rendering process, mitigating the risk of information exposure.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.5
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v0.9.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify their task templates to remove any sensitive environment variables or ensure that only task environment variables are used. This can be done by reviewing and updating the task configuration files to explicitly define the required environment variables and removing any unnecessary or sensitive ones. Here is an example of a modified task template:
{
"task": {
"env": {
"TASK_ENV_VARIABLE": "value"
}
}
}
Conclusion
In conclusion, the vulnerability identified as CVE-2019-14802 in Hashicorp Nomad versions prior to 0.9.5 allows for information exposure through environmental variables. To mitigate this risk, it is crucial to upgrade to the latest version of Nomad and ensure that task templates only use task environment variables. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
Hashicorp Nomad is an open-source cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a distributed infrastructure.
The vulnerability allows for information exposure through environmental variables, potentially leading to unauthorized access, data leakage, or other security breaches.
Versions of Nomad prior to 0.9.5 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Nomad version 0.9.5 or later.
Yes, a workaround is available. Users can manually modify their task templates to remove any sensitive environment variables or ensure that only task environment variables are used.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
