HashiCorp Nomad Event Stream Namespace ACL Policy Bypass Vulnerability

A vulnerability exists in both Nomad Community and Nomad Enterprise event streams that are configured with a wildcard namespace. This vulnerability allows for an ACL policy bypass, enabling unauthorized reads from other namespaces. The issue arises from a flaw in how ACL wildcards are validated, creating a discrepancy that can be exploited when using the event stream endpoint with a wildcard namespace.

Impact

Exploiting this vulnerability can lead to unauthorized access to event stream data from other namespaces, bypassing established ACL policies.

Remediation

Users should upgrade to Nomad Community Edition 1.9.6 or Nomad Enterprise 1.9.6, 1.8.10, or 1.7.18. For guidance on upgrading, refer to the Nomad Upgrade Guides.