HashiCorp Nomad: Symlink following during allocation data migration

Summary

HashiCorp Nomad and Nomad Enterprise follow symbolic links during same-client allocation data migration. A workload that can submit or update jobs can plant a symlink in a task-local directory, which Nomad preserves and later follows when setting directory permissions and ownership. On clients running as root, this can change permissions and ownership of host directories outside the allocation, enabling unauthorized access to host data, modification of host files and possibly privilege escalation (CVSS 8.8).

Affected

• Nomad: up to 2.1.0 according to HashiCorp advisory HCSEC-2026-53 (the CVE record lists from 0.5.3 to before 2.1.1)
• Nomad Enterprise: up to 2.0.7 according to HashiCorp advisory HCSEC-2026-53 (the CVE record lists from 0.5.3 to before 2.1.0)
• The lower bound 0.5.3 is not confirmed by the vendor advisory.
• The vendor advisory does not state the affected range for the Nomad Enterprise 1.10.x and 1.11.x branches.
• Only allocations that reuse data from a previous allocation (sticky ephemeral disk) on a client are affected.

Fixed in

• Nomad 2.1.1 (according to the HashiCorp advisory; some third-party databases list 2.1.0, so verify with HashiCorp)
• Nomad Enterprise 2.1.0
• Nomad Enterprise 1.11.12
• Nomad Enterprise 1.10.18

Workaround

Unknown. HashiCorp does not list a workaround; upgrading is the documented fix.

• Not vendor-confirmed: review sticky ephemeral disk settings (ephemeral_disk) and disable them on jobs that do not need data reuse.
• Not vendor-confirmed: restrict job submission and update rights to trusted users only.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof-of-concept exploit found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS: 0.13 % (percentile 3).
• The CVE is very recent, so the absence of evidence is not conclusive.

Our recommendation

• Inventory all Nomad and Nomad Enterprise clients and their versions.
• Upgrade to Nomad 2.1.1 or Nomad Enterprise 2.1.0, 1.11.12 or 1.10.18 (depending on branch).
• Prioritise clusters with multi-tenant or CI-driven job submission, and clusters using sticky ephemeral disk; patch these promptly.
• Small clusters where only trusted operators submit jobs can be patched in the next maintenance window.
• Check host directories for unexpected permission or ownership changes and monitor clients for symlinks in task directories.
• Consider the related HCSEC-2026-52 (CVE-2026-107347), which is fixed by the same upgrade.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HashiCorp Security Bulletin HCSEC-2026-53 discuss.hashicorp.com
• HashiCorp Security Bulletin HCSEC-2026-52 (related) discuss.hashicorp.com
• OffSeq Radar: CVE-2026-119168 radar.offseq.com
• VulDB: CVE-2026-119168 vuldb.com
• Linux Security: Nomad vulnerability host file writes linuxsecurity.com
• Vulners: PT-2026-132772 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:58.