{"id":"CVE-2021-43415","details":"HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.","aliases":["GHSA-2jhh-5xm2-j4gf","GO-2022-0573"],"modified":"2026-10-24T10:30:37.816551489Z","published":"2021-12-03T22:15:07.757Z","database_specific":{},"references":[{"type":"ADVISORY","url":"https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288"},{"type":"ADVISORY","url":"https://www.hashicorp.com/blog/category/nomad"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hashicorp/nomad","events":[{"introduced":"a480eed0815c54612856d9115a34bb1d1a773e8c"},{"fixed":"1fae1e1abaf06d55571cfe279788d915345ca5c4"},{"introduced":"f99f1e27bb66bee36a1f3cdf00335e81e93ffff2"},{"fixed":"189d3f1b8dbd2c6971752382e0800927d80edda7"},{"introduced":"bee0c3e04eb4ce34b8ac22ff27fcb421a9dccec5"},{"last_affected":"bee0c3e04eb4ce34b8ac22ff27fcb421a9dccec5"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.0.0"},{"fixed":"1.0.14"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*"},{"range":[{"introduced":"1.0.0"},{"fixed":"1.0.14"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*","range":[{"introduced":"1.1.0"},{"fixed":"1.1.8"}]},{"cpe":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"1.1.0"},{"fixed":"1.1.8"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:hashicorp:nomad:1.2.0:-:*:*:-:*:*:*","range":[{"introduced":"1.2.0-NA"},{"last_affected":"1.2.0-NA"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:hashicorp:nomad:1.2.0:-:*:*:enterprise:*:*:*","range":[{"introduced":"1.2.0-NA"},{"last_affected":"1.2.0-NA"}],"source":"CPE_STRING"}]}}],"versions":["1.2.0-NA","v1.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43415.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}