CVE-2023-1299: Nomad Job Submitter Privilege Escalation Using Workload Identity
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nomadto a version that resolves this vulnerability.Fixed in 1.5.1-r0 - Upgrade
Upgrade
HashiCorp Nomad and Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-1299.
What is the severity of CVE-2023-1299?
The severity of CVE-2023-1299 is high (8.8).
How does CVE-2023-1299 allow an attacker to escalate privileges?
CVE-2023-1299 allows a job submitter to escalate to management-level privileges using workload identity and task API.
Which versions of HashiCorp Nomad are affected by CVE-2023-1299?
HashiCorp Nomad 1.5.0 and Nomad Enterprise 1.5.0 are affected by CVE-2023-1299.
How can CVE-2023-1299 be fixed?
CVE-2023-1299 can be fixed by applying the patch/update to HashiCorp Nomad and Nomad Enterprise 1.5.1.