CVE-2021-37218: Hashicorp Nomad

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.

Affected products

• Hashicorp Nomad: before 1.0.10 (fixed in 1.0.10); up to and including 1.0.10; from 1.1.1, before 1.1.4 (fixed in 1.1.4)

Published 2021-09-07. Last modified 2026-06-17.