Symlink Following Vulnerability in HashiCorp Nomad and Nomad Enterprise
CVE-2026-107347

8.4HIGH

Key Information:

Vendor

Hashicorp
Status
Nomad
Nomad Enterprise
Vendor
CVE Published:
29 October 2026

What is CVE-2026-107347?

HashiCorp Nomad and Nomad Enterprise are susceptible to a symlink following flaw that occurs during dispatch payload and executor log writes. This vulnerability allows a malicious workload to modify files outside of its allocated directory. Particularly concerning is the scenario where the client agent operates with root privileges, potentially enabling the execution of arbitrary code on the client host. The issue has been addressed in the latest versions of Nomad.

Affected Version(s)

Nomad 64 bit 0.3.0 < 2.1.0

Nomad Enterprise 64 bit 0.3.0 < 2.1.0

References

https://discuss.hashicorp.com/t/hcsec-2026-52-nomad-dispa...

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Yonghwa Lee (Theori) and Habib (Syndicat3 Security Research Team).
.