CVE-2021-43415: Hashicorp Nomad

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

Affected products

• Hashicorp Nomad: from 1.0.0, before 1.0.14 (fixed in 1.0.14); from 1.1.0, before 1.1.8 (fixed in 1.1.8); version 1.2.0 only

Published 2021-12-03. Last modified 2026-06-17.