GHSA-hhvx-8755-4cvwMediumCVSS 5.3

Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables

Published
July 6, 2023
Last Modified
July 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-1296 →

📋 Description

A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.

🎯 Affected products2

  • go/github.com/hashicorp/nomad:>= 1.4.0, < 1.4.6
  • go/github.com/hashicorp/nomad:= 1.5.0

🔗 References (3)