Nomad Job Submitter Privilege Escalation Using Workload Identity

Vulnerability

Overview

CVE-2023-1299 affects HashiCorp Nomad and Nomad Enterprise version 1.5.0. The vulnerability allows a user with the submit-job ACL capability to escalate their privileges to the management level by abusing the workload identity feature. This issue was introduced when the identity block was added in Nomad 1.5.0, which exposes a workload identity token to tasks via a Unix domain socket, enabling HTTP API access without mTLS configuration [1][3].

Exploitation

Details

The core problem lies in the workload identity token's validation: if the token has no attached ACL policies, it can be used to gain higher privileges than intended. An attacker who can submit a malicious job can craft the workload identity to obtain management-level access to the Nomad API. The vulnerability does not require authentication bypass; it relies on a legitimate but insufficiently restricted capability [2][3].

Impact

Successful exploitation grants the attacker management-level privileges within the Nomad cluster. This allows full control over the cluster, including the ability to read and modify all variables, manipulate running jobs, and access sensitive data. The impact is high confidentiality, integrity, and availability compromise [2][3].

Mitigation

HashiCorp fixed this vulnerability in Nomad 1.5.1. Users running Nomad 1.5.0 should upgrade to 1.5.1 or later. No workarounds are mentioned; upgrading directly is the recommended remediation [3].