Executive brief
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
Affected products
- Go github.com/hashicorp/nomad
Junglewise Threat Intelligence
CVE-2024-6717: GO-2026-4278 - HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
CVE-2024-6717 · Severity: low · CVSS 3.1 · Published 2026-01-12
Technologies: github.com/hashicorp/nomad (Go). Vendors: Go.
Related threats
- HashiCorp Nomad path traversal in Dynamic Host Volumes
- HashiCorp Nomad arbitrary file read and write via symlink attack
- GO-2025-3758 - Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
- GO-2025-3510 - Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
- GO-2024-3354 - Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad