CVE-2023-1299

Fixed upstream EPSS <1%CVSS 7.4

HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.

Published 2023-03-14 · CVE record · OSV

Products: HashiCorp Nomad, HashiCorp Nomad Enterprise

Fixed upstream

Ecosystem	Package	Fixed in
Go	github.com/hashicorp/nomad	1.5.1

Distro releases

Release	Package	Fixed in
Ubuntu 18.04 LTS	nomad	no fix
Ubuntu 20.04 LTS	nomad	no fix