CVE-2021-32575: Improper network isolation in Hashicorp Nomad
Summary
CVE-2021-32575: Improper network isolation in Hashicorp Nomad. Affects github.com/hashicorp/nomad across 2 version ranges.
< 0.12.12
>= 1.0.0, < 1.0.5
Fixed in 0.12.12 or 1.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is a cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a distributed infrastructure. Nomad supports various networking modes, including bridge networking. Bridge networking allows tasks running on the same node to communicate with each other using the host's network stack. However, prior to version 1.0.5, Nomad's bridge networking mode was vulnerable to ARP spoofing, which could be exploited by other bridged tasks on the same node.
Vulnerability Detail
The vulnerability in HashiCorp Nomad's bridge networking mode allowed for ARP spoofing from other bridged tasks on the same node. ARP spoofing is a technique where an attacker sends falsified Address Resolution Protocol (ARP) messages over a local area network, leading to the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network. This can result in various security issues, such as interception of network traffic, denial of service, or man-in-the-middle attacks. The vulnerability was assigned a CVSS score of 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.12.120.12.12go get github.com/hashicorp/nomad@v0.12.12 -
>= 1.0.0, < 1.0.51.0.5go get github.com/hashicorp/nomad@v1.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of HashiCorp Nomad as mentioned above.
Conclusion
In conclusion, the vulnerability in HashiCorp Nomad's bridge networking mode allowed for ARP spoofing, which could lead to various security issues. It is recommended to update to the fixed versions of HashiCorp Nomad (1.0.5 or later for Nomad 1.x, and 0.12.12 or later for Nomad 0.x) to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is a cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a distributed infrastructure.
Bridge networking mode in Nomad allows tasks running on the same node to communicate with each other using the host's network stack.
ARP spoofing is a technique where an attacker sends falsified Address Resolution Protocol (ARP) messages over a local area network, leading to the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network.
ARP spoofing can result in various security issues, such as interception of network traffic, denial of service, or man-in-the-middle attacks.
The CVSS score of this vulnerability is 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
