PT-2023-16869 · Hashicorp+1 · Nomad+2

Published 2023-03-13 · Updated 2025-05-26 · CVE-2023-1296

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.5.0

Description A vulnerability was identified in Nomad and Nomad Enterprise such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access.

Recommendations For versions 1.4.0 through 1.5.0, update to version 1.4.6 or 1.5.1 to resolve the issue. As a temporary workaround, consider restricting access to workload variables until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-682

Related Identifiers

BDU:2025-06173

CVE-2023-1296

GHSA-HHVX-8755-4CVW

GO-2023-1899

Affected Products

Nomad

Nomad Enterprise

Red Os

References · 15

• https://osv.dev/vulnerability/GO-2023-1899 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1296 · Security Note
• https://ubuntu.com/security/CVE-2023-1296 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1296 · Security Note
• https://bdu.fstec.ru/vul/2025-06173 · Security Note
• https://osv.dev/vulnerability/GHSA-hhvx-8755-4cvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1296 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nomad-260525 · Note
• https://t.me/cvenotify/46117 · Telegram Post
• https://github.com/advisories/GHSA-hhvx-8755-4cvw · Note
• https://t.me/cibsecurity/59974 · Telegram Post