{"id":"CVE-2026-8052","sourceIdentifier":"security@hashicorp.com","published":"2026-05-12T20:16:46.720","lastModified":"2026-10-26T17:10:03.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver."},{"lang":"es","value":"El controlador de tareas exec2 de HashiCorp Nomad anterior a la versión 0.1.2 es vulnerable a la lectura y escritura arbitrarias de archivos en el host cliente como el usuario del proceso de Nomad a través de un ataque de enlace simbólico. Esta vulnerabilidad (CVE-2026-8052) está corregida en la versión 0.1.2 del controlador de tareas exec2."}],"affected":[{"source":"security@hashicorp.com","affectedData":[{"vendor":"HashiCorp","product":"Shared library","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad-driver-exec2","versions":[{"version":"0.1.0","lessThan":"0.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.5,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-12T20:22:26.659986Z","id":"CVE-2026-8052","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@hashicorp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-client-host-through-symlink-attack/77415","source":"security@hashicorp.com"}]}