HashiCorp

Nomad Enterprise (Nomad) jobs using the policy override option are bypassing the mandatory sentinel policies

CVE-2025-3744 7.6 - High - May 13, 2025

Nomad Enterprise (Nomad) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13.

HashiCorp Nomad Privilege Escalation via Unredacted Workload Identity Tokens

CVE-2024-12678 - December 20, 2024

Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.

Boundary Controller Initialization HTTP Request Handling Denial of Service Vulnerability

CVE-2024-12289 - December 12, 2024

Boundary Community Edition and Boundary Enterprise (Boundary) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.

Nomad 1.9.2: Arbitrary Cross-Namespace Volume Creation

CVE-2024-10975 - November 07, 2024

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.

A vulnerability was identified in Consul and Consul Enterprise (Consul) such

CVE-2024-10005 5.8 - Medium - October 30, 2024

A vulnerability was identified in Consul and Consul Enterprise (Consul) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.

Directory traversal

A vulnerability was identified in Consul and Consul Enterprise (Consul) such

CVE-2024-10006 5.8 - Medium - October 30, 2024

A vulnerability was identified in Consul and Consul Enterprise (Consul) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

Output Sanitization

A vulnerability was identified in Consul and Consul Enterprise such

CVE-2024-10086 6.1 - Medium - October 30, 2024

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

XSS

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path

CVE-2024-10228 3.3 - Low - October 29, 2024

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23

Incorrect Permission Assignment for Critical Resource

A privileged Vault operator with write permissions to the root namespaces identity endpoint could escalate their own or another users privileges to Vaults root policy

CVE-2024-9180 7.2 - High - October 10, 2024

A privileged Vault operator with write permissions to the root namespaces identity endpoint could escalate their own or another users privileges to Vaults root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Vault Community Edition and Vault Enterprise experienced a regression where functionality

CVE-2024-8365 6.5 - Medium - September 02, 2024

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMACd sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.

Insertion of Sensitive Information into Log File

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file

CVE-2024-6104 5.5 - Medium - June 24, 2024

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Insertion of Sensitive Information into Log File

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6

CVE-2024-1329 7.5 - High - February 08, 2024

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14.

Externally Controlled Reference to a Resource in Another Sphere

Boundary and Boundary Enterprise (Boundary) is vulnerable to session hijacking through TLS certificate tampering

CVE-2024-1052 8 - High - February 05, 2024

Boundary and Boundary Enterprise (Boundary) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.

Improper Certificate Validation

Vault and Vault Enterprise (Vault) may expose sensitive information when enabling an audit device

CVE-2024-0831 6.5 - Medium - February 01, 2024

Vault and Vault Enterprise (Vault) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.

Insertion of Sensitive Information into Log File

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests

CVE-2023-6337 7.5 - High - December 08, 2023

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.

Allocation of Resources Without Limits or Throttling

Patch in third party library Consul requires 'enable-script-checks' to be set to False

CVE-2023-5332 8.1 - High - December 04, 2023

Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory

CVE-2023-5954 7.5 - High - November 09, 2023

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

Memory Leak

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path

CVE-2023-5834 7.8 - High - October 27, 2023

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

insecure temporary file

A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace

CVE-2023-3775 4.9 - Medium - September 29, 2023

A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets

CVE-2023-5077 7.5 - High - September 29, 2023

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Incorrect Permission Assignment for Critical Resource

HashiCorp Vault and Vault Enterprise transit secrets engine

CVE-2023-4680 6.8 - Medium - September 15, 2023

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

Improper Input Validation

Terraform version 1.0.8 through 1.5.6

CVE-2023-4782 7.8 - High - September 08, 2023

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Directory traversal

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly

CVE-2023-3518 7.3 - High - August 09, 2023

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method

CVE-2023-3462 5.3 - Medium - July 31, 2023

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

Side Channel Attack

An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash

CVE-2023-3774 4.9 - Medium - July 28, 2023

An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.

Improper Handling of Exceptional Conditions

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results

CVE-2023-3072 3.8 - Low - July 20, 2023

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

AuthZ

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results

CVE-2023-3299 2.7 - Low - July 20, 2023

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

Exposure of Resource to Wrong Sphere

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API

CVE-2023-3300 5.3 - Medium - July 20, 2023

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.

AuthZ

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools

CVE-2023-3114 7.7 - High - June 22, 2023

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.

AuthZ

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values

CVE-2023-2121 5.4 - Medium - June 09, 2023

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

XSS

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state

CVE-2023-1297 7.5 - High - June 02, 2023

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances

CVE-2023-2816 6.5 - Medium - June 02, 2023

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms

CVE-2023-2197 2.5 - Low - May 01, 2023

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vaults root key. Fixed in 1.13.2

Inadequate Encryption Strength

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2

CVE-2023-1782 9.8 - Critical - April 05, 2023

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

AuthZ

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata

CVE-2023-0665 6.5 - Medium - March 30, 2023

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks

CVE-2023-25000 4.7 - Medium - March 30, 2023

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Side Channel Attack

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend

CVE-2023-0620 6.7 - Medium - March 30, 2023

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.

SQL Injection

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workloads variables

CVE-2023-1296 5.3 - Medium - March 14, 2023

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workloads variables. Fixed in 1.4.6 and 1.5.1.

AuthZ

HashiCorp Nomad and Nomad Enterprise 1.5.0

CVE-2023-1299 8.8 - High - March 14, 2023

HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.

HashiCorp Vault and Vault Enterprises approle auth method

CVE-2023-24999 8.1 - High - March 11, 2023

HashiCorp Vault and Vault Enterprises approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

AuthZ

Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow

CVE-2023-0845 6.5 - Medium - March 09, 2023

Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.

NULL Pointer Dereference

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source

CVE-2023-0821 6.5 - Medium - February 16, 2023

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs

CVE-2023-0475 6.5 - Medium - February 16, 2023

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted

CVE-2023-0690 7.1 - High - February 08, 2023

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI workers disk. This issue is fixed in version 0.12.0.

Missing Encryption of Sensitive Data

HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering

CVE-2019-14802 5.3 - Medium - December 26, 2022

HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI

CVE-2022-3920 7.5 - High - November 16, 2022

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

AuthZ

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected

CVE-2022-3867 4.3 - Medium - November 10, 2022

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

Insufficient Session Expiration

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/

CVE-2022-3866 4.3 - Medium - November 10, 2022

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

Exposure of Resource to Wrong Sphere

Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which

CVE-2022-36182 6.1 - Medium - October 27, 2022

Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.

Clickjacking

HashiCorp Vault and Vault Enterprises TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup

CVE-2022-41316 5.3 - Medium - October 12, 2022

HashiCorp Vault and Vault Enterprises TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

Improper Certificate Validation