CVE-2024-12678: Hashicorp Nomad Privilege Escalation Vulnerability
Summary
CVE-2024-12678: Hashicorp Nomad Incorrect Privilege Assignment vulnerability. Affects github.com/hashicorp/nomad versions < 1.9.4. Fixed in 1.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Nomad is a flexible, enterprise-grade workload orchestrator that enables users to deploy and manage applications across a cluster of machines. It supports various workloads, including containers, virtual machines, and standalone applications. Nomad is designed for high availability and scalability, making it a popular choice for organizations looking to manage their infrastructure efficiently. However, it is susceptible to a privilege escalation vulnerability that can occur within a namespace due to unredacted workload identity tokens.
Vulnerability Detail
The vulnerability identified as CVE-2024-12678 affects both Nomad Community and Nomad Enterprise editions. It allows for privilege escalation within a namespace, potentially enabling unauthorized access to sensitive resources. This issue arises from the improper handling of workload identity tokens, which are not adequately redacted. Attackers could exploit this vulnerability to gain elevated privileges, leading to unauthorized actions within the system. The severity of this vulnerability is classified as moderate, with a CVSS score of 6.5, indicating a significant risk that should be addressed promptly.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.4
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.9.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of workload identity tokens by implementing stricter access controls and monitoring token usage. This can help mitigate the risk until the software is updated. Additionally, consider reviewing and auditing the permissions assigned to workloads to minimize potential damage from exploitation.
Conclusion
The privilege escalation vulnerability CVE-2024-12678 in Hashicorp Nomad poses a moderate risk to users, allowing unauthorized access through unredacted workload identity tokens. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, implementing strict access controls can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
CVE-2024-12678 is a vulnerability in Hashicorp Nomad that allows for privilege escalation within a namespace due to unredacted workload identity tokens.
If you are using versions prior to 1.9.4 for Nomad Community or earlier than 1.9.4, 1.8.8, or 1.7.16 for Nomad Enterprise, your installation is affected by this vulnerability.
Exploitation of this vulnerability could allow attackers to gain elevated privileges, leading to unauthorized access and actions within your Nomad environment.
To update your Nomad installation, download the latest version from the Hashicorp website or use your package manager. For Go modules, run go get github.com/hashicorp/nomad@v1.9.4.
Vulert is a monitoring tool that alerts users to open-source vulnerabilities in their software. It uses the Gopkg.lock file to check for vulnerabilities in real-time, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
