CVE-2019-14802

Published: Dec 26, 2022Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.

Affected (1)

Products: Hashicorp: Nomad

Hashicorp

1 product

Nomad

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Nomad	From 0.5.0 to 0.9.5

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html

Source: cve@mitre.org

Third Party Advisory

https://www.hashicorp.com/blog/category/nomad

Source: cve@mitre.org

ProductVendor Advisory

https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.hashicorp.com/blog/category/nomad

Source: af854a3a-2127-422b-91ae-364da2661108

ProductVendor Advisory

Timeline

No history available yet.