Nomad ACLs Can Not Deny Access to Workload's Own Variables

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and...

Nomad’s Workload Identity Token Can List Non-sensitive Metadata For nomad/ Paths

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace.This vulnerability, CVE-2022-3866, was fixed in Nomad 1.4.2. Background Nomad’s...

Nomad Raft RPC Privilege Escalation

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that client agents can escalate privileges by directly communicating with the server agent’s Raft RPC layer. This vulnerability, CVE-2021-37218, was fixed in Nomad 1.0.10 and 1.1.4. Background Nomad uses mTLS for...