Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-7956

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-7956
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:14 UTC · Revision 1

Source evidence

CVE-2020-7956

core-osv · Original source

Published 31 Jan 2020, 13:15 UTC

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

osv:CVE-2020-7956
Complete source record
{
  "id": "f9b4277bca275c285043ef494b06ec8effa40e8f5f66b1b0adb9718580c637a6",
  "url": "https://osv.dev/vulnerability/CVE-2020-7956",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-7956",
    "summary": "HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.",
    "evidence": "osv:CVE-2020-7956",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2020-7956",
      "aliases": [
        "CVE-2020-7956",
        "GHSA-cj2h-ww36-v932",
        "GO-2022-0821"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hashicorp/nomad",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "74e08d5af48918120c48a74b44d0860905770b82"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.10.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.10.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.10.2",
            "v0.10.2-rc1",
            "v0.10.0-beta1",
            "v0.9.4",
            "v0.9.4-rc1",
            "v0.9.3",
            "v0.9.2",
            "v0.9.2-rc1",
            "v0.9.0",
            "v0.9.0-rc2",
            "v0.9.0-rc1",
            "v0.9.0-beta3",
            "v0.9.0-beta2",
            "v0.9.0-beta1",
            "v0.8.4",
            "v0.8.4-rc1",
            "v0.8.3",
            "v0.8.2",
            "v0.8.0",
            "v0.8.0+pro",
            "v0.8.0-rc1+pro",
            "v0.8.0-rc1",
            "v0.7.1+pro",
            "v0.7.1",
            "v0.7.1-rc1+pro",
            "v0.7.1-rc1",
            "v0.7.0",
            "v0.7.0-rc3",
            "v0.7.0-rc2",
            "v0.7.0-rc1",
            "v0.6.3-rc1",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.6.0-rc2",
            "v0.6.0-rc1",
            "v0.5.6",
            "v0.5.6-rc1",
            "v0.5.5",
            "v0.5.5-rc2",
            "v0.5.5-rc1",
            "v0.5.3",
            "v0.5.2",
            "v0.5.2-rc1",
            "v0.5.1",
            "v0.5.1-rc2",
            "v0.5.1-rc1",
            "v0.5.0",
            "v0.5.0-rc2",
            "v0.5.0-rc1",
            "v0.4.1",
            "v0.4.1-rc1",
            "v0.4.0",
            "v0.4.0-rc2",
            "v0.4.0-rc1",
            "v0.3.2",
            "v0.3.2-rc2",
            "v0.3.2-rc1",
            "v0.3.1",
            "v0.3.0-rc2",
            "v0.3rc1",
            "v0.2.3",
            "v0.2.3-rc1",
            "v0.2.2",
            "v0.2.1",
            "show",
            "v0.2.0",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0",
            "v0.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7956.json"
          }
        }
      ],
      "modified": "2026-10-20T10:53:30.918577239Z",
      "provider": "osv",
      "references": [
        "https://github.com/hashicorp/nomad/issues/7003",
        "https://www.hashicorp.com/blog/category/nomad/"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-7956",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 384392,
  "published_at": "2020-01-31T13:15:10.877+00:00"
}