CVE-2020-7956

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hashicorp/nomad/issues/7003Third Party Advisory
https://www.hashicorp.com/blog/category/nomad/Vendor Advisory
https://github.com/hashicorp/nomad/issues/7003Third Party Advisory
https://www.hashicorp.com/blog/category/nomad/Vendor Advisory

Timeline

Published: Jan 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79575.3The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the s CVE-2020-79586.0An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privile CVE-2020-79595.3LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database CVE-2020-79619.8Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser CVE-2020-79625.3An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an at CVE-2020-79645.3An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attacker CVE-2020-79658.8flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the CVE-2020-79667.5GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.CVE-2020-79674.3GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).CVE-2020-79687.5GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.CVE-2020-79697.5GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.CVE-2020-79716.1GitLab EE 11.0 and later through 12.7.2 allows XSS.