CVE-2021-37218: Privilege escalation in Hashicorp Nomad
Summary
CVE-2021-37218: Privilege escalation in Hashicorp Nomad. Affects github.com/hashicorp/nomad across 2 version ranges.
< 1.0.10
>= 1.1.0, < 1.1.4
Fixed in 1.0.10 or 1.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is a cluster manager and scheduler designed for microservices and batch applications. It provides a platform for deploying and managing applications across a distributed infrastructure. The vulnerability in Nomad's Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, leading to privilege escalation.
Vulnerability Detail
The vulnerability (CVE-2021-37218) in HashiCorp Nomad enables non-server agents to gain unauthorized access to server-only functionality by using a valid certificate signed by the same CA. This allows for privilege escalation, potentially leading to unauthorized control over the cluster and its applications. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.0.101.0.10go get github.com/hashicorp/nomad@v1.0.10 -
>= 1.1.0, < 1.1.41.1.4go get github.com/hashicorp/nomad@v1.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of HashiCorp Nomad.
Conclusion
The vulnerability in HashiCorp Nomad (CVE-2021-37218) allows non-server agents to escalate privileges by accessing server-only functionality. To mitigate this risk, it is crucial to upgrade to the fixed versions of HashiCorp Nomad (1.0.10 or 1.1.4). For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is a cluster manager and scheduler designed for microservices and batch applications. It provides a platform for deploying and managing applications across a distributed infrastructure.
The vulnerability allows non-server agents to gain unauthorized access to server-only functionality, leading to privilege escalation. This can potentially result in unauthorized control over the cluster and its applications.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the latest versions of HashiCorp Nomad (1.0.10 or 1.1.4). These versions address the issue and prevent non-server agents from accessing server-only functionality.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of HashiCorp Nomad.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
