cve.bz

CVE-2024-10975

7.7 highEPSS 0.4%

High (7.7) in hashicorp nomad. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/nomad 1.9.2.

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.

Severity

CVSS 3.1

7.7 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2w5v-x29g-jw7jGogithub.com/hashicorp/nomad<=1.9.1no fix published
GO-2024-3262Gogithub.com/hashicorp/nomad<1.9.21.9.2

References

Check your stackJSON