PT-2023-22921 · Hashicorp+1 · Nomad Enterprise+2

Published 2023-07-19 · Updated 2025-05-26 · CVE-2023-3072

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 0.7.0 through 1.5.6 HashiCorp Nomad and Nomad Enterprise version 1.4.10

Description A vulnerability in HashiCorp Nomad and Nomad Enterprise allows an ACL policy using a block without a label to generate unexpected results, potentially applying to unexpected resources. This issue affects the Nomad scheduler, designed for effortless operations and management of applications.

Recommendations For HashiCorp Nomad and Nomad Enterprise versions 0.7.0 through 1.5.6, update to version 1.5.7 or later to resolve the issue. For HashiCorp Nomad and Nomad Enterprise version 1.4.10, update to version 1.4.11 to resolve the issue. As a temporary workaround, consider restricting the use of ACL policies using blocks without labels until a patch is available.

Fix

Missing Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-862

CWE-266

Related Identifiers

BDU:2025-06166

CVE-2023-3072

GHSA-RPVR-38XV-XVXQ

GO-2024-2670

Affected Products

Hashicorp Nomad

Nomad Enterprise

Red Os

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3072 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpvr-38xv-xvxq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3072 · Security Note
• https://bdu.fstec.ru/vul/2025-06166 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3072 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2670 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3072 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-3072 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2023-20-nomad-acl-policies-without-label-are-applied-to-unexpected-resources/56270 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/96231 · Telegram Post
• https://pkg.go.dev/vuln/GO-2024-2670 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nomad-cve-2023-3072 · Note