{"id":"EUVD-2026-29827","enisaUuid":"34877096-d476-338c-9e26-6b215f26c379","description":"HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.","datePublished":"May 12, 2026, 7:09:15 PM","dateUpdated":"May 12, 2026, 8:22:44 PM","baseScore":6.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","references":"https://discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-client-host-through-symlink-attack/77415\n","aliases":"CVE-2026-8052\n","assigner":"HashiCorp","epss":0.13,"enisaIdProduct":[{"id":"657b8034-0fab-333c-9b38-63a1363afe42","product":{"name":"Shared library","vendor":{"name":"Hashicorp"}},"product_version":"0.1.0 \u003c0.1.2"}],"enisaIdVendor":[{"id":"464fc010-2004-325b-acbf-0c6212778f12","vendor":{"name":"Hashicorp"}}],"enisaIdVulnerability":[{"id":"03acb3a2-dc66-3c07-af34-80582bf7e64f","vulnerability":{"id":"GHSA-wqwc-x3rc-2xw6","description":"HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack","datePublished":"May 12, 2026, 9:31:35 PM","dateUpdated":"May 19, 2026, 3:39:35 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-8052\nhttps://discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-client-host-through-symlink-attack/77415\nhttps://github.com/hashicorp/nomad-driver-exec2\nhttps://github.com/hashicorp/nomad-driver-exec2/releases/tag/v0.1.2\n","enisa_id":"EUVD-2026-29827\n","aliases":"GHSA-wqwc-x3rc-2xw6\nCVE-2026-8052\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"16f5e5fa-fc68-3d48-9405-0bca54719dc2","vulnerability":{"id":"CVE-2026-8052","description":"HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.","datePublished":"May 12, 2026, 7:09:15 PM","dateUpdated":"May 12, 2026, 8:22:44 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","references":"https://discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-client-host-through-symlink-attack/77415\n","enisa_id":"EUVD-2026-29827\n","assigner":"HashiCorp","epss":0.13,"dataProcessed":"Oct 30, 2026, 7:18:04 AM","vulnerabilityProduct":[{"id":"27657469-5da6-336a-8629-39571ee04c6a","product":{"name":"Shared library","vendor":{"name":"Hashicorp"}},"product_version":"0.1.0 \u003c0.1.2"}],"vulnerabilityVendor":[{"id":"2c5026c0-c701-3079-95ce-c961e94ed2d9","vendor":{"name":"Hashicorp"}}]}}],"enisaIdAdvisory":[]}