Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Nomad and Nomad Enterprise Java Task Driver Security Risk

CVE-2021-3283 · published 5 years ago
Summary

Nomad and Nomad Enterprise's Java task driver allows unauthorized access to other tasks on the same node. This means that if a malicious task gains access to a node, it could potentially access and interfere with other tasks running on the same node. To fix this issue, update to version 0.12.10 or 1.0.3.

What to do
  • Update github.com hashicorp to version 1.0.3.
  • Update github.com hashicorp to version 0.12.10.
Affected software
Ecosystem VendorProductAffected versions
go github.com hashicorp >= 1.0.0, < 1.0.3
< 0.12.10
Fix: upgrade to 1.0.3
– hashicorp nomad < 0.12.10
>= 1.0.0, < 1.0.3
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*
Original advisory text
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published1 Feb 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-35qp-xq9f-2rjx · GHSA
CVE-2021-3283 · NVD
Track software like this
Free during beta