CVE-2023-1296 Nomad ACLs Can Not Deny Access to Workload's Own Variables

[tgross]

Summary:

A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.

Background:

Nomad 1.4.0 introduced the variables feature, and a new workload identity feature so that tasks can access their own variables without needing to create and pass a Nomad ACL token.

Details:

An OSS user reported an unexpected behavior where adding a policy with a deny capability did not deny access to a variable.

Remediation:

Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.4.6, 1.5.1, or newer.