CVE-2020-7956: Improper Certificate Validation in HashiCorp Nomad
Summary
CVE-2020-7956: Improper Certificate Validation in HashiCorp Nomad in github.com/hashicorp/nomad. Affects github.com/hashicorp/nomad versions < 0.10.3. Fixed in 0.10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HashiCorp Nomad is a Go-based cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a distributed infrastructure. The vulnerability in HashiCorp Nomad allows for improper certificate validation, potentially leading to unauthorized access or man-in-the-middle attacks.
Vulnerability Detail
The vulnerability arises from the improper validation of certificates in HashiCorp Nomad. This can allow an attacker to present a malicious certificate that appears valid to the application, leading to unauthorized access or interception of sensitive information. The impact of this vulnerability can be severe, compromising the confidentiality and integrity of data transmitted within the Nomad cluster.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.3
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v0.10.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of HashiCorp Nomad.
Conclusion
The vulnerability in HashiCorp Nomad allows for improper certificate validation, potentially leading to unauthorized access or man-in-the-middle attacks. It is crucial to upgrade to version 0.10.3 or later to mitigate this vulnerability and ensure the security of the Nomad cluster.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is a cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a distributed infrastructure.
The vulnerability allows for improper certificate validation, potentially leading to unauthorized access or man-in-the-middle attacks. It can compromise the confidentiality and integrity of data transmitted within the Nomad cluster.
To fix this vulnerability, it is recommended to upgrade to version 0.10.3 or later of HashiCorp Nomad. This version includes the necessary fixes to properly validate certificates and mitigate the vulnerability.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of HashiCorp Nomad.
For more information about this vulnerability, you can refer to the CVE-2020-7956 entry or the HashiCorp Nomad documentation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
