CVE-2023-3072

MediumCVSS 4.1

Published: 20/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

In HashiCorp Nomad and Nomad Enterprise versions 0.7.0 to 1.5.6 and 1.4.10, ACL policies using a block without a label generate unexpected results. This issue is fixed in versions 1.6.0, 1.5.7, and 1.4.11.

Risk Assessment

Incorrect results from ACL policies may lead to unauthorized access or improper resource management in the system, posing a security risk to the organization.

Recommendation

It is recommended to upgrade to versions 1.6.0, 1.5.7, or 1.4.11 to mitigate this vulnerability.

Original NVD description (English source)

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.