Riskcovery

CVE-2026-119168

Nomad allocation data migration may allow host directory permission modification via symlink following

State
Published
Severity
8.8 High
Published
Oct 29, 2026
Updated
Oct 29, 2026
Reserved
Oct 29, 2026

Read the record on cve.org

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HHashiCorp

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access (Link Following)

Affected Products

ProductVersions
NomadHashiCorp
  • 0.5.3 to before 2.1.0Affected
Nomad EnterpriseHashiCorp
  • 0.5.3 to before 2.1.0Affectedfrom 1.11.12Not affectedfrom 1.10.18Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.