CVE-2024-12678

6.5 mediumEPSS 0.5%

Medium (6.5) in hashicorp nomad. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/nomad 1.9.4.

Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE: CWE-266
Published: 2024-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hashicorp:nomad

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-hr68-hvgv-xxqf	Go	github.com/hashicorp/nomad	<1.9.4	1.9.4
GO-2024-3354	Go	github.com/hashicorp/nomad	<1.9.4	1.9.4

References

https://discuss.hashicorp.com/t/hcsec-2024-29-nomad-allocations-vulnerable-to-privilege-escalation-within-a-namespace-using-unredacted-workload-identity-token/72119

Check your stack JSON