CVE-2024-12678

What it actually does

The flaw allows privilege escalation inside a namespace by exposing unredacted workload identity tokens that can be used to impersonate other workloads.

Why it matters to the business

Attackers who already have a foothold in one workload can gain unauthorized access to other resources within the same namespace, increasing the chance of lateral movement and data exposure in container orchestration environments.

How an attack unfolds

An attacker running code inside an allocation obtains the unredacted workload identity token, then uses that token to authenticate as a different workload and perform actions that should be restricted by namespace boundaries.

How to fix it

Upgrade Nomad Community Edition to 1.9.4 and Nomad Enterprise to 1.9.4, 1.8.8, or 1.7.16. Verify that workload identity token redaction is enabled after the upgrade.

How to confirm the fix worked

Confirm the installed Nomad version meets or exceeds the fixed releases, then inspect allocation logs and token issuance behavior to ensure identity tokens are redacted before being presented to workloads.

Typical attack path

1. Compromise or deploy a workload inside a Nomad namespace
2. Extract the unredacted workload identity token from the allocation
3. Use the token to request Nomad API operations as another identity
4. Escalate privileges within the namespace to access additional resources

How to detect it

Search Nomad server and client logs for workload identity token issuance events that lack redaction markers, and look for API calls using tokens that do not match the expected allocation identity.

What your security team should do

• Apply the listed Nomad version upgrades immediately on all clusters
• Audit existing allocations for any workloads that may have received unredacted tokens
• Review namespace isolation policies and reduce unnecessary cross-workload token access