{"id":"EUVD-2026-29825","enisaUuid":"1c32b71c-80c5-3c0c-9d49-dc9d4988137e","description":"HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.","datePublished":"May 12, 2026, 6:59:09 PM","dateUpdated":"May 12, 2026, 8:16:15 PM","baseScore":6.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","references":"https://discuss.hashicorp.com/t/hcsec-2026-14-nomad-arbitrary-file-read-write-on-client-host-through-symlink-attack/77416\n","aliases":"CVE-2026-6959\n","assigner":"HashiCorp","epss":0.17,"enisaIdProduct":[{"id":"1dc539aa-b5c7-3dfd-9145-1110d5f8de27","product":{"name":"Nomad Enterprise","vendor":{"name":"Hashicorp"}},"product_version":"0.9.0 \u003c2.0.1"},{"id":"24c7a153-625e-31c8-948a-43795cb26e70","product":{"name":"Nomad","vendor":{"name":"Hashicorp"}},"product_version":"0.9.0 \u003c2.0.1"}],"enisaIdVendor":[{"id":"310501e5-84a5-3a5b-b203-e64f1af8e68e","vendor":{"name":"Hashicorp"}}],"enisaIdVulnerability":[{"id":"4ecdffd0-fb1b-3903-a6e2-50baa4ca225d","vulnerability":{"id":"GHSA-3934-423w-4jq3","description":"HashiCorp Nomad vulnerable to symlink attack","datePublished":"May 12, 2026, 9:31:35 PM","dateUpdated":"May 19, 2026, 3:39:41 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-6959\nhttps://github.com/hashicorp/nomad/commit/2a09fd62c23880ff306499ae03fe64628d82a23f\nhttps://discuss.hashicorp.com/t/hcsec-2026-14-nomad-arbitrary-file-read-write-on-client-host-through-symlink-attack/77416\nhttps://github.com/hashicorp/nomad\nhttps://github.com/hashicorp/nomad/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-29825\n","aliases":"CVE-2026-6959\nGHSA-3934-423w-4jq3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"691e03d3-bc6a-3a2b-be37-0a446da63a56","vulnerability":{"id":"CVE-2026-6959","description":"HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.","datePublished":"May 12, 2026, 6:59:09 PM","dateUpdated":"May 12, 2026, 8:16:15 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","references":"https://discuss.hashicorp.com/t/hcsec-2026-14-nomad-arbitrary-file-read-write-on-client-host-through-symlink-attack/77416\n","enisa_id":"EUVD-2026-29825\n","assigner":"HashiCorp","epss":0.17,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"2084ef1a-9a84-385c-ae7d-3227d6539e9d","product":{"name":"Nomad Enterprise","vendor":{"name":"Hashicorp"}},"product_version":"0.9.0 \u003c2.0.1"},{"id":"d84d707b-50ce-3ac8-aee9-7e1a83c1c36f","product":{"name":"Nomad","vendor":{"name":"Hashicorp"}},"product_version":"0.9.0 \u003c2.0.1"}],"vulnerabilityVendor":[{"id":"c14f0ba4-23c2-3e61-9486-bb3f11ca3b6c","vendor":{"name":"Hashicorp"}}]}}],"enisaIdAdvisory":[]}