GHSA-9jfx-84v9-2rr2
GitHub Security Advisory
Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel
✓ GitHub Reviewed
LOW
Has CVE
Advisory Details
A vulnerability was identified in Nomad such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Affected Packages
Go
github.com/hashicorp/nomad
Affected versions:
1.2.11
(fixed in 1.4.11)
Go
github.com/hashicorp/nomad
Affected versions:
1.5.0
(fixed in 1.5.7)
Related CVEs
Key Information
2.5
/10
Dataset
Last updated: November 26, 2025 6:30 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.