GO-2026-4278
NoneCVSS
—
EPSS
—
Published
Jan 12, 2026
CISA due date
—
The record
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/hashicorp/nomad | 0 | 1.11.1 |
| Go | github.com/hashicorp/nomad | 0 | 1.8.2 |
Related vulnerabilities
- CVE-2024-6717 HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking… Same vulnerability
- CVE-2024-12678 Hashicorp Nomad Incorrect Privilege Assignment vulnerability Also affects github.com/hashicorp/nomad
- CVE-2024-10975 Hashicorp Nomad Incorrect Authorization vulnerability Also affects github.com/hashicorp/nomad
- CVE-2024-7625 In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the… Also affects github.com/hashicorp/nomad