CVE-2024-12678: Hashicorp Nomad Incorrect Privilege Assignment Vulnerability
Summary
CVE-2024-12678: Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad. Affects github.com/hashicorp/nomad versions < 1.9.4. Fixed in 1.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Nomad is a flexible, enterprise-grade cluster manager and scheduler designed for deploying and managing applications across a distributed infrastructure. It provides features such as job scheduling, resource management, and service discovery. However, like many complex systems, it can be susceptible to vulnerabilities that may compromise its security and functionality. The specific vulnerability identified as CVE-2024-12678 relates to incorrect privilege assignments within the Nomad package, potentially allowing unauthorized access to certain functionalities.
Vulnerability Detail
The vulnerability in Hashicorp Nomad arises from incorrect privilege assignments, which can lead to unauthorized users gaining access to restricted functionalities. This issue may allow an attacker to perform actions that should be limited to privileged users, potentially leading to data breaches or service disruptions. The vulnerability affects versions of Nomad prior to 1.9.4, and it is crucial for users to understand the implications of this flaw to mitigate risks effectively.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.4
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.9.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to Nomad's functionalities by implementing stricter access controls and ensuring that only authorized personnel have the necessary permissions to interact with the system. This may involve reviewing and adjusting user roles and permissions within the Nomad configuration.
Conclusion
The CVE-2024-12678 vulnerability in Hashicorp Nomad highlights the importance of maintaining up-to-date software and implementing proper access controls. Users are encouraged to update to version 1.9.4 or later to mitigate the risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
CVE-2024-12678 is a vulnerability in Hashicorp Nomad that involves incorrect privilege assignments, potentially allowing unauthorized access to restricted functionalities.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects all versions of Hashicorp Nomad prior to 1.9.4.
If immediate updates are not possible, implement stricter access controls to limit user permissions and mitigate the risk of exploitation.
More details can be found in the vulnerability database at https://pkg.go.dev/vuln/GO-2024-3354.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
