VULNERABILITY INTELLIGENCE

CVE-2021-43415

CVSS score8.8 HIGH

EPSS probability1.22%

CISA KEVNot currently listed

Published2021-12-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

Weakness classification

nvd@nist.gov: NVD-CWE-Other

Primary references

cve@mitre.org — Mitigation, Vendor Advisory
cve@mitre.org — Product, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory