CVE-2024-12678: Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens
Published Dec 20, 2024
·Updated
Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.
Affected Software
5 affected componentsFixes available
go/github.com/hashicorp/nomad<1.9.4
1.9.4
HashiCorp Nomad>=1.4.0<1.7.16
HashiCorp Nomad>=1.4.0<1.9.4
HashiCorp Nomad>=1.8.0<1.8.8
HashiCorp Nomad>=1.9.0<1.9.4
Event History
Dec 20, 2024
CVE Published
via MITRE·01:49 AM
Data Sourced
via MITRE·01:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
Affected Software
Advisory Published
via GitHub·03:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-12678?
CVE-2024-12678 has been classified as a privilege escalation vulnerability.
2
How do I fix CVE-2024-12678?
To remediate CVE-2024-12678, upgrade to Nomad Community Edition 1.9.4 or Nomad Enterprise 1.9.4.
3
What versions of Nomad are affected by CVE-2024-12678?
CVE-2024-12678 affects all Nomad versions prior to 1.9.4.
4
What are the implications of CVE-2024-12678?
CVE-2024-12678 allows an attacker to escalate privileges within a namespace using unredacted workload identity tokens.
5
Is CVE-2024-12678 present in both Nomad Community and Enterprise versions?
Yes, CVE-2024-12678 affects both Nomad Community and Nomad Enterprise versions.