PT-2023-24122 · Hashicorp+1 · Hashicorp Nomad Enterprise+1

Published 2023-07-19 · Updated 2025-05-26 · CVE-2023-3299

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad Enterprise versions 1.2.11 through 1.5.6 HashiCorp Nomad Enterprise version 1.4.10

Description A vulnerability exists where the API caller's ACL token secret ID is exposed to Sentinel policies. Additionally, ACL policies using a block without a label generate unexpected results.

Recommendations For HashiCorp Nomad Enterprise versions 1.2.11 through 1.5.6, update to version 1.5.7 or later. For HashiCorp Nomad Enterprise version 1.4.10, update to version 1.4.11 or later. For HashiCorp Nomad Enterprise versions prior to 1.6.0, update to version 1.6.0 or later. As a temporary workaround, consider restricting access to Sentinel policies to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-201

CWE-668

Related Identifiers

BDU:2025-06176

CVE-2023-3299

GHSA-9JFX-84V9-2RR2

GO-2024-2669

Affected Products

Hashicorp Nomad Enterprise

Red Os

References · 15

• https://bdu.fstec.ru/vul/2025-06176 · Security Note
• https://osv.dev/vulnerability/GO-2024-2669 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-3299 · Security Note
• https://osv.dev/vulnerability/GHSA-9jfx-84v9-2rr2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3299 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-3299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3299 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3299 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/issues/17907 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/96244 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nomad-260525 · Note
• https://pkg.go.dev/vuln/GO-2024-2669 · Note