# HCSEC-2023-09 - Nomad ACLs Can Not Deny Access to Workload's Own Variables

**URL:** <https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390>\
**Category:** Security\
**Tags:** security-nomad\
**Created:** [March 13, 2023, 9:00pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390 "2023-03-13T21:00:34Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [March 13, 2023, 9:00pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390/1 "2023-03-13T21:00:35Z")

</div>

**Bulletin ID:** HCSEC-2023-09  
**Affected Products / Versions:** Nomad and Nomad Enterprise 1.4.0 up to 1.5.0; fixed in 1.4.6 and 1.5.1.  
**Publication Date:** March 13, 2023

**Summary**  
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a `deny` ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.

**Background**  
Nomad 1.4.0 introduced the [variables](https://developer.hashicorp.com/nomad/docs/concepts/variables) feature, and a new [workload identity](https://developer.hashicorp.com/nomad/docs/concepts/workload-identity) feature so that tasks can access their own variables without needing to create and pass a Nomad ACL token.

**Details**  
An OSS user reported an unexpected behavior where adding a policy with a deny capability did not deny access to a variable, which was confirmed with internal investigation.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.4.6, 1.5.1, or newer. See Nomad’s [Upgrading](https://www.nomadproject.io/docs/upgrade) for general guidance on this process.

**Acknowledgement**  
This issue was identified by the HashiCorp OSS community.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._