CVE-2023-1782: HashiCorp Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation
Summary
CVE-2023-1782: HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation. Affects github.com/hashicorp/nomad versions >= 1.5.0, < 1.5.3. Fixed in 1.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is an open-source cluster manager and scheduler designed for deploying and managing applications across a distributed infrastructure. It provides a flexible and scalable platform for orchestrating containers, virtual machines, and other workloads. Nomad is written in Go and is widely used in production environments. However, versions 1.5.0 up to 1.5.2 of Nomad and Nomad Enterprise have been found to have a vulnerability that allows unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled.
Vulnerability Detail
The vulnerability in HashiCorp Nomad allows unauthenticated users to exploit a privilege escalation issue in the client agent's HTTP request handling. This vulnerability can be leveraged to bypass access control restrictions and gain unauthorized access to sensitive resources within the cluster. The issue arises when mTLS (mutual Transport Layer Security) is not enabled, allowing unauthenticated clients to make requests that should be restricted to authenticated users. This can lead to unauthorized actions, data exposure, and potential compromise of the entire cluster. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.3
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.5.3 is not immediately feasible, a temporary workaround is to enable mTLS for the Nomad cluster. Enabling mTLS ensures that only authenticated clients can make requests and helps prevent unauthorized access. The following code snippet demonstrates how to enable mTLS in a Nomad configuration file:
# Enable mTLS
tls {
http = true
}
Conclusion
In conclusion, the vulnerability in HashiCorp Nomad allows unauthenticated users to bypass ACL authorizations and gain unauthorized access to sensitive resources within the cluster. Upgrading to version 1.5.3 or enabling mTLS are recommended solutions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is an open-source cluster manager and scheduler used for deploying and managing applications across a distributed infrastructure. It provides a flexible and scalable platform for orchestrating containers, virtual machines, and other workloads.
Versions 1.5.0 up to 1.5.2 of HashiCorp Nomad and Nomad Enterprise are affected by this vulnerability.
This vulnerability allows unauthenticated users to bypass ACL authorizations and gain unauthorized access to sensitive resources within the Nomad cluster. It can lead to unauthorized actions, data exposure, and potential compromise of the entire cluster.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to version 1.5.3 of HashiCorp Nomad or Nomad Enterprise. This version includes a fix for the privilege escalation issue and ensures that ACL authorizations are properly enforced.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
