CVE-2023-1782: Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-1782.

Q: What is the severity of CVE-2023-1782?

The severity of CVE-2023-1782 is critical with a severity value of 9.8.

Q: Which versions of HashiCorp Nomad and Nomad Enterprise are affected?

Versions 1.5.0 up to 1.5.2 of HashiCorp Nomad and Nomad Enterprise are affected.

Q: How can unauthenticated users bypass ACL authorizations in affected versions of HashiCorp Nomad and Nomad Enterprise?

Unauthenticated users can bypass intended ACL authorizations for clusters where mTLS is not enabled.

Q: How can I fix CVE-2023-1782?

Update to version 1.5.3 of HashiCorp Nomad or Nomad Enterprise to fix the vulnerability.

Published Apr 5, 2023

Updated

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

Affected Software

4 affected componentsFixes available

HashiCorp Nomad>=1.5.0<=1.5.2

alpine/nomad>=1.5.0<1.5.3-r0

1.5.3-r0

ubuntu/nomad*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/nomad to a version that resolves this vulnerability.
Fixed in 1.5.3-r0
Upgrade
Upgrade HashiCorp Nomad to a version that resolves this vulnerability.
Fixed in 1.5.3

Event History

Apr 5, 2023

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·08:15 PM

DescriptionSeverityAffected Software

Nov 6, 2026

Withdrawn

via OSV·10:02 AM

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-1782.

What is the severity of CVE-2023-1782?