PT-2024-37819 · Hashicorp+1 · Nomad Enterprise+2

Published 2024-07-22 · Updated 2026-01-17 · CVE-2024-6717

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.6.12 through 1.7.9 HashiCorp Nomad and Nomad Enterprise version 1.8.1

Description The issue concerns archive unpacking during migration, where path escaping of the allocation directory is possible. This allows for potential exploitation. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For HashiCorp Nomad and Nomad Enterprise versions 1.6.12 through 1.7.9, update to version 1.7.10 or later to resolve the issue. For HashiCorp Nomad and Nomad Enterprise version 1.8.1, update to version 1.8.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-610

Related Identifiers

BDU:2025-06168

CVE-2024-6717

GHSA-5MQX-RPXV-MVXJ

GO-2026-4278

SUSE-SU-2026:0142-1

Affected Products

Hashicorp Nomad

Nomad Enterprise

Red Os

References · 53

• https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6717 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mqx-rpxv-mvxj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6717 · Security Note
• https://osv.dev/vulnerability/GO-2026-4278 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6717 · Security Note
• https://bdu.fstec.ru/vul/2025-06168 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6717 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6717 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/pull/27068/commits/d0f4f27dd03e7f9843d7b921ca9f33c257efdfd1 · Note
• https://github.com/hashicorp/nomad/releases/tag/v1.11.1 · Note
• https://github.com/hashicorp/nomad/commit/ef6cdec8847e0698d386d1fd3761743df758ef99 · Note
• https://github.com/hashicorp/nomad/releases/tag/v1.8.2 · Note