CVE-2024-1329 is a high severity arbitrary file write in the template renderer of HashiCorp Nomad and Nomad Enterprise, scored 7.7. It affects 1.5.13 up to 1.6.6, and 1.7.3. HashiCorp fixed it in 1.7.4, 1.6.7 and the 1.5 line. Upgrade your Nomad clients.
What's affected
The record and HashiCorp's bulletin HCSEC-2024-03 say Nomad and Nomad Enterprise 1.5.13 through 1.6.6, and 1.7.3, are affected. The template renderer can be abused to write files on the host as the Nomad client user through symlinks.
The fixed versions are 1.7.4, 1.6.7 and, for the 1.5 line, one of two numbers. The NVD description says 1.5.14, while the Remediation section of the HashiCorp page I read says 1.5.15. The page is inconsistent with itself, so verify the 1.5 fix against the Nomad changelog before you rely on either.
The bulletin does not state a severity score. The 7.7 comes from NVD, with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H. Note the scope changed flag, which reflects impact beyond the task's own sandbox.
Weakness class: CWE-59, CWE-610. The NVD record carries the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H and a score of 7.7.
How to check if you're exposed
Check the version on each client and server:
nomad version
nomad node status
The second command lists nodes, and nomad node status with a node ID shows its client version. HashiCorp recommends keeping servers and clients on the same version. Upgrading clients is enough to apply the fix.
Also review who can submit jobs. The flaw needs an actor who can run workloads that use templates, so anyone with job submission rights on a shared cluster matters.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Upgrade Nomad clients to 1.7.4, 1.6.7 or a verified fixed 1.5 release.
- Keep servers on matching versions.
- On Windows, run workloads as non-Administrator users, and run Docker containers as ContainerUser, since HashiCorp says this prevents symlink creation.
- Avoid raw_exec with untrusted workloads. The fix does not protect Windows raw_exec tasks, per HashiCorp.
- Leave the file sandbox on. Setting client.disable_file_sandbox to true turns the protection off.
Why it matters
The class is link following (CWE-59) together with CWE-610, a reference to a resource controlled by someone else. A template renderer that follows a symbolic link written by a task can be steered to write outside the folder it should stay in.
HashiCorp's fix sandboxes template input and output. On Linux and Unix it uses a chroot into the allocation directory, which needs a privileged Nomad process, and on Windows it uses an AppContainer. The record's KEV flag is false and the bulletin does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Nomad releases fix CVE-2024-1329?
1.7.4 and 1.6.7, and a 1.5 release, which the sources give as 1.5.14 and 1.5.15, so check the changelog.
Do I need to upgrade servers too?
HashiCorp says upgrading clients is sufficient, and recommends matching versions.
Sources
Last reviewed: 19 October 2026.
