Vulnerability Database

309,364

Total vulnerabilities in the database

CVE-2021-43415

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

Published: Dec 3, 2021
Updated: Nov 16, 2025
CVE: CVE-2021-43415
GHSA: GHSA-2jhh-5xm2-j4gf
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6
AV:N/AC:M/Au:S/C:P/I:P/A:P

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
hashicorp / nomad	1.0.0	1.0.14
hashicorp / nomad	1.1.0	1.1.8
hashicorp / nomad	1.2.0	1.2.0.x
github.com/hashicorp/nomad	-	1.0.14
github.com/hashicorp/nomad	1.1.0	1.1.8
github.com/hashicorp/nomad	1.2.0	1.2.1

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo