HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/hashicorp/nomad(Go) | 0.11.0 | 1.4.11 | N/A |
| github.com/hashicorp/nomad(Go) | 1.5.0 | 1.5.7 | N/A |
CVSS Metrics
