# HCSEC-2020-05 - Nomad's mTLS Authorization Mechanism Susceptible to Privilege Escalation

**URL:** <https://discuss.hashicorp.com/t/hcsec-2020-05-nomads-mtls-authorization-mechanism-susceptible-to-privilege-escalation/18088>\
**Category:** Security\
**Tags:** security-nomad\
**Created:** [November 25, 2020, 6:55pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-05-nomads-mtls-authorization-mechanism-susceptible-to-privilege-escalation/18088 "2020-11-25T18:55:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [November 25, 2020, 6:55pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-05-nomads-mtls-authorization-mechanism-susceptible-to-privilege-escalation/18088/1 "2020-11-25T18:55:29Z")

</div>

**Bulletin ID:** HCSEC-2020-05  
**Affected Products / Versions:** Nomad and Nomad Enterprise, up to 0.10.2; fixed in 0.10.3.  
**Publication Date:** 24 January, 2020

**Summary**  
Nomad and Nomad Enterprise (“Nomad”) up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Assigned CVE-2020-7956, this vulnerability was fixed in Nomad 0.10.3.

**Background**  
Securing Nomad’s cluster communication is not only important for security but can even ease operations by preventing mistakes and misconfigurations. Nomad optionally uses mutual TLS (mTLS) for all HTTP and RPC communication. See [Enable TLS Encryption for Nomad](https://learn.hashicorp.com/tutorials/nomad/security-enable-tls) for more information.

**Details**  
It was observed that Nomad incorrectly validated the role/region associated with TLS certificates used for mTLS RPC, and was susceptible to privilege escalation.

**Remediation**  
Customers should upgrade to Nomad or Nomad Enterprise 0.10.3, or newer. Please refer to [Upgrading Nomad](https://www.nomadproject.io/docs/upgrade) for general guidance and version-specific upgrade notes.

**Acknowledgement**  
This issue was identified by an external party who reported it privately to HashiCorp.

_We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._