CVE-2024-12678: 
Nomad vulnerability analysis and mitigation

CVE-2024-12678 affects Nomad Community and Nomad Enterprise ("Nomad") allocations, making them vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. The vulnerability was discovered in December 2024 and affects Nomad Community Edition from 1.4.0 up to 1.9.3 and Nomad Enterprise from 1.4.0 up to 1.9.3, 1.8.7, and 1.7.15 (HashiCorp Discussion).

The vulnerability stems from the exposure of Workload Identity tokens through the Read Allocation API or alloc command. These tokens provide access to workload-associated variables and service discovery. When combined with workload-associated ACL policies, users with namespace:read access can potentially escalate privileges and access additional policies for any workload within the namespace. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (HashiCorp Discussion).

The vulnerability allows users with namespace:read access to potentially escalate their privileges and access additional policies for any workload within the namespace, compromising the intended access control boundaries (HashiCorp Discussion).

The vulnerability can be exploited by accessing Nomad allocations through the Read Allocation API or alloc command, which exposes the Workload Identity token. This token, when combined with workload-associated ACL policies, enables privilege escalation within the namespace (HashiCorp Discussion).

The vulnerability has been fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise versions 1.9.4, 1.8.8, and 1.7.16. Organizations are advised to evaluate their risk and upgrade to these patched versions. Users should refer to the Nomad Upgrade Guides for version-specific upgrade instructions (HashiCorp Discussion).