CVE-2024-10975

What it actually does

Authorization bypass in Nomad volume specification allows unauthorized CSI volume writes that create volumes across namespaces.

Why it matters to the business

Attackers may gain unauthorized access to storage resources in other namespaces, risking data exposure or integrity issues in container workloads; low EPSS and no KEV status indicate limited observed exploitation but patching remains important given the 2024 disclosure.

How an attack unfolds

An attacker submits a crafted volume specification to a Nomad cluster that bypasses namespace authorization checks on CSI operations, resulting in creation of volumes in unauthorized namespaces.

How to fix it

Upgrade Nomad Community Edition to 1.9.2 and Nomad Enterprise to 1.9.2, 1.8.7, or 1.7.15; note that the provided chromium-browser and oxide-qt fixed versions appear unrelated to this Nomad vulnerability.

How to confirm the fix worked

Confirm installed Nomad version matches a fixed release and test that CSI volume creation attempts from one namespace cannot affect another.

Typical attack path

1. Obtain ability to submit volume specifications to a Nomad cluster
2. Craft CSI volume request that omits or manipulates namespace boundaries
3. Trigger volume creation through the vulnerable code path
4. Access or manipulate storage objects in the target namespace

How to detect it

Review Nomad server and client logs for CSI volume write operations that reference unexpected namespaces or lack proper authorization context.

What your security team should do

• Apply the listed Nomad version upgrades without delay
• Audit existing CSI volume policies to enforce namespace isolation
• Enable and review Nomad audit logs for volume creation events