CVE-2020-28348: Path Traversal in HashiCorp Nomad
Summary
CVE-2020-28348: Path Traversal in HashiCorp Nomad. Affects github.com/hashicorp/nomad across 3 version ranges.
>= 0.9.0, < 0.10.8
>= 0.11.0-beta1, < 0.11.7
>= 0.12.0-beta1, < 0.12.8
Fixed in 0.10.8, 0.11.7 or 0.12.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is a scheduling and orchestration tool for containerized and non-containerized applications. It provides a platform for managing and deploying applications across a cluster of machines. The vulnerability in Nomad and Nomad Enterprise versions 0.9.0 up to 0.12.7 allows for path traversal attacks when the client Docker file sandbox feature is not explicitly disabled or when using a volume mount type.
Vulnerability Detail
The path traversal vulnerability in HashiCorp Nomad allows an attacker to access files outside of the intended directory. This can lead to unauthorized access, data leakage, and potential remote code execution. The vulnerability is rated as moderate with a CVSS score of 6.5. It affects the Nomad client Docker file sandbox feature when not explicitly disabled or when using a volume mount type.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.9.0, < 0.10.80.10.8go get github.com/hashicorp/nomad@v0.10.8 -
>= 0.11.0-beta1, < 0.11.70.11.7go get github.com/hashicorp/nomad@v0.11.7 -
>= 0.12.0-beta1, < 0.12.80.12.8go get github.com/hashicorp/nomad@v0.12.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround is to disable the client Docker file sandbox feature or avoid using the volume mount type. By explicitly disabling the sandbox feature or using alternative methods for file access, the risk of path traversal attacks can be mitigated.
Conclusion
The path traversal vulnerability in HashiCorp Nomad can be mitigated by upgrading to the fixed versions or implementing the provided workarounds. It is important to take immediate action to protect systems and data from potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is a scheduling and orchestration tool for containerized and non-containerized applications. It provides a platform for managing and deploying applications across a cluster of machines.
The path traversal vulnerability in Nomad allows an attacker to access files outside of the intended directory. This can lead to unauthorized access, data leakage, and potential remote code execution.
To fix the vulnerability, it is recommended to upgrade to the fixed versions of HashiCorp Nomad (0.12.8, 0.11.7, or 0.10.8) and review/update related configurations.
Yes, if immediate upgrade is not possible, you can disable the client Docker file sandbox feature or avoid using the volume mount type to mitigate the risk.
The vulnerability is rated as moderate with a CVSS score of 6.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
