Riskcovery

CVE-2023-1296

Nomad ACLs Can Not Deny Access to Workload's Own Variables

State
Published
Severity
2.7 Low
Published
Mar 14, 2023
Updated
Feb 27, 2025
Reserved
Mar 9, 2023

Read the record on cve.org

Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.

Scores

CVSSScoreVectorSource
3.12.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NHashiCorp

Weaknesses

Affected Products

ProductVersions
NomadHashiCorp
  • 1.5.0Affected
  • 1.4.0 to before 1.4.6Affected
Nomad EnterpriseHashiCorp
  • 1.5.0Affected
  • 1.4.0 to before 1.4.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.