CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-1782
Critical (9.8) in hashicorp nomad. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/nomad 1.5.3.
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:nomad
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f8r8-h93m-mj77 | Go | github.com/hashicorp/nomad | >=1.5.0 <1.5.3 | 1.5.3 |
| GO-2023-1707 | Go | github.com/hashicorp/nomad | >=1.5.0 <1.5.3 | 1.5.3 |