Headline
GHSA-f8r8-h93m-mj77: HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation
High severity GitHub Reviewed Published Apr 5, 2023 to the GitHub Advisory Database • Updated Apr 6, 2023
Related news
CVE-2023-1782: HCSEC-2023-12 - Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.