CVE-2024-10975: Hashicorp Nomad

High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.

Affected products

• Hashicorp Nomad: from 1.3.0, before 1.7.15 (fixed in 1.7.15); from 1.3.0, before 1.9.2 (fixed in 1.9.2); from 1.8.0, before 1.8.7 (fixed in 1.8.7); from 1.9.0, before 1.9.2 (fixed in 1.9.2)

Published 2024-11-07. Last modified 2026-06-17.