CVE-2024-10975 Overview
CVE-2024-10975 affects HashiCorp Nomad Community and Nomad Enterprise. The vulnerability allows arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. Attackers with limited privileges in one namespace can create CSI volumes in other namespaces they should not access. This flaw stems from improper authorization enforcement in the volume specification handling logic, classified as [CWE-863] Incorrect Authorization.
HashiCorp addressed the issue in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.
Critical Impact
Authenticated users with CSI write permission in any namespace can create volumes across namespace boundaries, breaking Nomad's multi-tenancy isolation model and enabling integrity violations against other tenant workloads.
Affected Products
- HashiCorp Nomad Community Edition versions prior to 1.9.2
- HashiCorp Nomad Enterprise versions prior to 1.9.2, 1.8.7, and 1.7.15
- Deployments using Container Storage Interface (CSI) plugins with multi-namespace configurations
Discovery Timeline
- 2024-11-07 - CVE-2024-10975 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10975
Vulnerability Analysis
Nomad implements namespaces to provide multi-tenant isolation for workloads, volumes, and secrets. The CSI volume specification defines which namespace owns a given volume and enforces access based on Access Control List (ACL) policies. This vulnerability breaks that model by permitting a caller with CSI write permission in one namespace to submit a volume specification that targets a different namespace.
The scope-changed impact means an authenticated attacker affects resources beyond their authorized security scope. While confidentiality and availability are not directly impacted, the integrity of tenant boundaries is compromised. Cross-namespace volume creation can disrupt storage planning, exhaust CSI plugin capacity, or stage further attacks against unrelated workloads.
Root Cause
The root cause is missing enforcement of the target namespace during CSI volume creation requests. Nomad validated that the caller held CSI write capability but did not verify that the capability applied to the namespace declared in the volume specification. This is a classic [CWE-863] Incorrect Authorization pattern where the authorization decision uses the wrong subject or resource context.
Attack Vector
An attacker requires network access to the Nomad HTTP API and an ACL token with csi-write-volume (or equivalent) permission in at least one namespace. The attacker submits a volume creation request with the Namespace field set to a namespace they do not control. Because Nomad fails to re-check authorization against the specified namespace, the request succeeds and the volume is registered under the target namespace. Exploitation requires no user interaction and executes over the standard Nomad API.
Refer to the HashiCorp Security Advisory HCSEC-2024-27 for vendor-published technical details.
Detection Methods for CVE-2024-10975
Indicators of Compromise
- CSI volume registration events where the requesting token's namespace differs from the created volume's namespace
- Unexpected volumes appearing in production or restricted namespaces without corresponding change management records
- API audit log entries showing PUT /v1/volume/csi/:volume_id calls with mismatched namespace context
- Sudden growth in CSI plugin volume counts unrelated to legitimate workload deployments
Detection Strategies
- Enable Nomad audit logging (Enterprise) and alert on volume creation events where the token namespace does not match the request namespace
- Baseline expected CSI volume creators per namespace and flag deviations
- Correlate Nomad API access logs with ACL token metadata to identify cross-namespace write patterns
Monitoring Recommendations
- Forward Nomad server and audit logs to a centralized SIEM for retention and correlation
- Monitor CSI plugin controller logs for volume provisioning requests originating from unexpected namespaces
- Review ACL token inventories quarterly and revoke tokens with broader CSI permissions than required
How to Mitigate CVE-2024-10975
Immediate Actions Required
- Upgrade Nomad Community Edition to version 1.9.2 or later
- Upgrade Nomad Enterprise to version 1.9.2, 1.8.7, or 1.7.15 depending on your release train
- Audit existing CSI volumes and remove any created outside their expected namespace
- Rotate ACL tokens that hold CSI write capabilities as a precaution
Patch Information
HashiCorp released fixes in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. See the HashiCorp Security Advisory HCSEC-2024-27 for release notes and upgrade guidance.
Workarounds
- Restrict CSI write permissions in ACL policies to the minimum set of operators who require them
- Segregate CSI plugins per tenant so cross-namespace registration cannot reach unrelated storage backends
- Place the Nomad HTTP API behind network controls that limit which clients can reach volume management endpoints
- Review and tighten namespace-scoped ACL policies before granting csi-write-volume to workload teams
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
