CVE-2022-24683: Arbitrary file reads in HashiCorp Nomad
Summary
CVE-2022-24683: Arbitrary file reads in HashiCorp Nomad. Affects github.com/hashicorp/nomad across 3 version ranges.
>= 0.9.2, < 1.0.18
>= 1.1.0, < 1.1.12
>= 1.2.0, < 1.2.6
Fixed in 1.0.18, 1.1.12 or 1.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. It is written in Go and is widely used for managing and scheduling workloads. However, Nomad versions 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 are vulnerable to arbitrary file reads, which can be exploited by operators with certain capabilities to read arbitrary files on the host filesystem as root.
Vulnerability Detail
The vulnerability in HashiCorp Nomad allows operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. This can lead to unauthorized access to sensitive information and potential privilege escalation. The issue has a CVSS score of 7.5, indicating a high severity level. There are currently no known workarounds, and users are strongly advised to upgrade to the fixed versions as soon as possible to mitigate the risk.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.9.2, < 1.0.181.0.18go get github.com/hashicorp/nomad@v1.0.18 -
>= 1.1.0, < 1.1.121.1.12go get github.com/hashicorp/nomad@v1.1.12 -
>= 1.2.0, < 1.2.61.2.6go get github.com/hashicorp/nomad@v1.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
HashiCorp Nomad versions 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 are vulnerable to arbitrary file reads, which can result in unauthorized access to sensitive information and potential privilege escalation. Users are strongly advised to upgrade to the fixed versions (1.0.18, 1.1.12, or 1.2.6) as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is a workload orchestrator used for deploying various types of applications and managing workloads.
The vulnerability allows operators with certain capabilities to read arbitrary files on the host filesystem as root, potentially leading to unauthorized access to sensitive information and privilege escalation.
No, there are currently no known workarounds for this vulnerability. Upgrading to the fixed versions is the recommended solution.
The fixed versions of HashiCorp Nomad are 1.0.18, 1.1.12, and 1.2.6. Users should upgrade to one of these versions to mitigate the vulnerability.
To upgrade HashiCorp Nomad, follow the official upgrade instructions provided by HashiCorp. These instructions will guide you through the process of upgrading to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
