HashiCorp Nomad vulnerable to non-sensitive metadata exposure

MEDIUM 4.3CVE-2022-3866 · GHSA-7wg4-8m5p-hrfg · GO-2022-1105 · Published 10/11/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/nomad Go	`≥ 1.4.0, < 1.4.2`	`1.4.2`
nomad hashicorp	`= 1.4.0= 1.4.1`	No fix yet

Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

NVD description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2022-3866 · ADVISORY
hashicorp/nomad commit 3b24f26 · WEB
discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167 · WEB
hashicorp/nomad · PACKAGE
GitHub Advisory GHSA-7wg4-8m5p-hrfg · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free