PT-2023-16869 · Hashicorp+1 · Nomad+2

CVE-2023-1296 · Publicado 2023-03-13 · Atualizado 2025-05-26

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.5.0

Description A vulnerability was identified in Nomad and Nomad Enterprise such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access.

Recommendations For versions 1.4.0 through 1.5.0, update to version 1.4.6 or 1.5.1 to resolve the issue. As a temporary workaround, consider restricting access to workload variables until a patch is available.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-682

Identificadores relacionados

BDU:2025-06173

CVE-2023-1296

GHSA-HHVX-8755-4CVW

GO-2023-1899

Produtos afetados

Nomad

Nomad Enterprise

Red Os

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1296.json · Exploit
• https://github.com/hashicorp/nomad · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1296 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-1296 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hhvx-8755-4cvw · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-06173 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1296 · Aviso do Fabricante
• https://t.me/cibsecurity/59974 · Publicação no Telegram
• https://t.me/cvenotify/46117 · Publicação no Telegram
• https://github.com/advisories/GHSA-hhvx-8755-4cvw · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nomad-260525 · Nota
• https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1899 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1296 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-1296 · Nota de Segurança