CVE-2024-10975: Hashicorp Nomad Incorrect Authorization Vulnerability
Summary
CVE-2024-10975: Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad. Affects github.com/hashicorp/nomad versions < 1.9.2. Fixed in 1.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Nomad is a flexible, enterprise-grade cluster manager and scheduler designed to handle the deployment and management of applications across a distributed infrastructure. It supports various workloads, including Docker containers, virtual machines, and standalone applications. Nomad is known for its simplicity and scalability, making it a popular choice for organizations looking to manage their resources efficiently. However, like any software, it is susceptible to vulnerabilities that can compromise its security and functionality.
Vulnerability Detail
The vulnerability identified as CVE-2024-10975 in Hashicorp Nomad pertains to incorrect authorization mechanisms within the application. This flaw allows unauthorized users to gain access to certain functionalities or data that should be restricted. The root cause of this issue lies in the way Nomad handles user permissions and access controls, potentially leading to unauthorized actions being performed by malicious actors. If exploited, this vulnerability could result in data breaches, unauthorized resource manipulation, and overall compromise of the system's integrity.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.2
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.9.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Nomad API and ensure that only trusted users have the necessary permissions to interact with the system. This can be achieved by configuring firewall rules or using network policies to limit access to the Nomad server.
Conclusion
The CVE-2024-10975 vulnerability in Hashicorp Nomad highlights the importance of maintaining strict authorization controls within software applications. Users are encouraged to update to the latest version to mitigate risks and protect their systems from potential exploitation.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
CVE-2024-10975 is a vulnerability in Hashicorp Nomad that involves incorrect authorization, allowing unauthorized access to certain functionalities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential impacts include unauthorized access to sensitive data, manipulation of resources, and overall compromise of the system's security.
You can update Hashicorp Nomad by running 'go get github.com/hashicorp/nomad@latest' in your terminal to ensure you have the latest patched version.
Yes, a recommended workaround is to restrict access to the Nomad API and ensure that only trusted users have the necessary permissions.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
