CVE-2021-37218: 
Nomad vulnerability analysis and mitigation

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. This vulnerability (CVE-2021-37218) was fixed in Nomad versions 1.0.10 and 1.1.4 (HashiCorp Discussion).

The vulnerability exists in Nomad's mTLS implementation for agent communication between Nomad client and server agents. While mTLS provides encrypted and authenticated RPC channels, the authentication logic failed to properly restrict client agents from accessing server-only Raft RPC functionality. Using a non-server certificate from the configured Nomad CA allowed unauthorized access to server-only Raft RPC functions (HashiCorp Discussion).

This vulnerability allows client agents to escalate privileges by directly communicating with the server agent's Raft RPC layer, potentially gaining unauthorized access to server-only functionality (HashiCorp Discussion).

Users should upgrade to Nomad or Nomad Enterprise versions 1.0.10, 1.1.4, or newer. The fix includes modifications to Nomad's RPC authentication logic to correctly enforce server-only access for the Raft RPC layer (HashiCorp Discussion).