Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-k9md-c96w-7kg1
Vulnerability ID VCID-k9md-c96w-7kg1
Aliases CVE-2022-24686
GHSA-gwmc-6795-qghj
Summary HashiCorp Nomad Artifact Download Race Condition HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
System Score Found at
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
epss 0.00356 https://api.first.org/data/v1/epss?cve=CVE-2022-24686
cvssv3.1 5.9 https://discuss.hashicorp.com
generic_textual MODERATE https://discuss.hashicorp.com
cvssv3.1 5.9 https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
generic_textual MODERATE https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
cvssv3.1 5.9 https://github.com/hashicorp/nomad
generic_textual MODERATE https://github.com/hashicorp/nomad
cvssv3.1 5.9 https://github.com/hashicorp/nomad/issues/12036
generic_textual MODERATE https://github.com/hashicorp/nomad/issues/12036
cvssv3.1 5.9 https://github.com/hashicorp/nomad/releases/tag/v1.2.6
generic_textual MODERATE https://github.com/hashicorp/nomad/releases/tag/v1.2.6
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2022-24686
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-24686
cvssv3.1 5.9 https://security.netapp.com/advisory/ntap-20220318-0008
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20220318-0008
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-24686
https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
https://github.com/hashicorp/nomad
https://github.com/hashicorp/nomad/issues/12036
https://github.com/hashicorp/nomad/releases/tag/v1.2.6
https://nvd.nist.gov/vuln/detail/CVE-2022-24686
https://security.netapp.com/advisory/ntap-20220318-0008
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://discuss.hashicorp.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/hashicorp/nomad
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/hashicorp/nomad/issues/12036
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/hashicorp/nomad/releases/tag/v1.2.6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-24686
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20220318-0008
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.57833
EPSS Score 0.00356
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:06:25.334737+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-gwmc-6795-qghj/GHSA-gwmc-6795-qghj.json 38.0.0