Skip to content
OpenAdvisories
Critical · 10.0 CVE-2023-1782 EUVD-2023-1283GHSA-f8r8-h93m-mj77GO-2023-1707

Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation

Published Apr 5, 2023 · Updated Feb 10, 2025 · Assigned by HashiCorp

Vendor: HashiCorp Product: Nomad Product: Nomad Enterprise Package: github.com/hashicorp/nomad Package: nomad Package: nomad Ecosystem: Alpine Ecosystem: Go Ecosystem: Ubuntu

Description

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

Affected products

VendorProductAffectedFixed
HashiCorp Nomad 1.5.0 – < 1.5.3 1.5.3
HashiCorp Nomad Enterprise 1.5.0 – < 1.5.3 1.5.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.18 nomad 1.5.3-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/hashicorp/nomad >= 1.5.0, < 1.5.3 1.5.3 GHSA-f8r8-h93m-mj77

References