CVE-2023-1299: 
Nomad vulnerability analysis and mitigation

HashiCorp Nomad and Nomad Enterprise version 1.5.0 contained a vulnerability (CVE-2023-1299) that allowed users with submit-job ACL capability to escalate their privileges to management-level through workload identity and task API exploitation. The vulnerability was discovered during internal testing and was fixed in version 1.5.1. The issue was introduced with the implementation of workload identity features in Nomad 1.5.0 (HashiCorp Discuss).

The vulnerability stems from the workload identity feature introduced in Nomad 1.4.0, which allows tasks to access variables without requiring direct access through the Nomad HTTP API with an ACL token. In version 1.5.0, an identity block was introduced that exposed the workload identity token to the workload, enabling access to the Nomad HTTP API via a unix domain socket without mTLS configuration. The security flaw specifically manifested when workload identity had no attached ACL policies, creating a potential privilege escalation path (HashiCorp Discuss).

The vulnerability enables users with basic job submission privileges to gain unauthorized management-level access to the system, potentially compromising the security and integrity of the Nomad cluster (HashiCorp Discuss).

Organizations should upgrade to Nomad version 1.5.1 or newer to address this vulnerability. HashiCorp has provided upgrade guidance in their Nomad's Upgrading documentation (HashiCorp Discuss).