GHSA-f8r8-h93m-mj77
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/nomad | >= 1.5.0, < 1.5.3 | 1.5.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
References
External links from the advisory. They lead to third-party sites.