id: GO-2024-2669
modules:
    - module: github.com/hashicorp/nomad
      versions:
        - introduced: 1.2.11
        - fixed: 1.4.11
        - introduced: 1.5.0
        - fixed: 1.5.7
      vulnerable_at: 1.5.6
summary: API token secret ID leak to Sentinel in github.com/hashicorp/nomad
description: |-
    A vulnerability exists in Nomad where the API caller's ACL token secret
    ID is exposed to Sentinel policies.
cves:
    - CVE-2023-3299
ghsas:
    - GHSA-9jfx-84v9-2rr2
credits:
    - anonymous4ACL24
references:
    - report: https://github.com/hashicorp/nomad/issues/17907
    - web: https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271
review_status: REVIEWED