CVE-2021-43415

Published: Dec 3, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

Affected (6)

Products: Hashicorp: Nomad

Hashicorp

1 product

Nomad

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Nomad	From 1.0.0 to 1.0.14
Hashicorp Nomad	From 1.1.0 to 1.1.8
Hashicorp Nomad	From 1.0.0 to 1.0.14
Hashicorp Nomad	From 1.1.0 to 1.1.8
Hashicorp Nomad	Version 1.2.0
Hashicorp Nomad	Version 1.2.0

References (4)

https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288

Source: cve@mitre.org

MitigationVendor Advisory

https://www.hashicorp.com/blog/category/nomad

Source: cve@mitre.org

ProductVendor Advisory

https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

https://www.hashicorp.com/blog/category/nomad

Source: af854a3a-2127-422b-91ae-364da2661108

ProductVendor Advisory

Timeline

No history available yet.