PT-2024-17712 · Hashicorp+2 · Hashicorp Nomad+2

Published 2024-12-19 · Updated 2025-12-12 · CVE-2024-12678

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hashicorp Nomad versions prior to 1.9.4 Hashicorp Nomad versions prior to 1.8.8 Hashicorp Nomad versions prior to 1.7.16

Description The issue is related to privilege escalation within a namespace through unredacted workload identity tokens. This allows for potential exploitation, although specific details about the number of affected devices or real-world incidents are not provided.

Recommendations For versions prior to 1.9.4, update to Nomad Community Edition 1.9.4. For versions prior to 1.8.8, update to Nomad Enterprise 1.8.8. For versions prior to 1.7.16, update to Nomad Enterprise 1.7.16.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-03334

CVE-2024-12678

GHSA-HR68-HVGV-XXQF

GO-2024-3354

OPENSUSE-SU-2024:14608-1

OPENSUSE-SU-2025_0060-1

SUSE-SU-2025:0060-1

Affected Products

Hashicorp Nomad

Red Os

Suse

References · 42

• https://discuss.hashicorp.com/t/hcsec-2024-29-nomad-allocations-vulnerable-to-privilege-escalation-within-a-namespace-using-unredacted-workload-identity-token/72119 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-12678 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-12678 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03334 · Security Note
• https://osv.dev/vulnerability/GHSA-hr68-hvgv-xxqf · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14608-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3354 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12678 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-12678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12678 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:0060-1 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/commit/359a71861ef044cb5d749a36ff0e44b172c8f1a6 · Note
• https://suse.com/security/cve/CVE-2024-54148 · Note
• https://redos.red-soft.ru/support/secure · Note