CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-30324
Critical (9.8) in hashicorp nomad. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/nomad 1.1.14, 1.2.8, 1.3.1.
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:nomad
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-526x-rm7j-v389 | Go | github.com/hashicorp/nomad | >=0.2.0 <1.1.14 | 1.1.14 |
| GHSA-526x-rm7j-v389 | Go | github.com/hashicorp/nomad | >=1.2.0 <1.2.8 | 1.2.8 |
| GHSA-526x-rm7j-v389 | Go | github.com/hashicorp/nomad | >=1.3.0 <1.3.1 | 1.3.1 |
| GO-2022-0732 | Go | github.com/hashicorp/nomad | >=0.2.0 <1.1.14 >=1.2.0 <1.2.8 >=1.3.0 <1.3.1 | 1.1.14, 1.2.8, 1.3.1 |