CVE-2026-119168

Nomad allocation data migration may allow host directory permission modification via symlink following

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-119168

Published

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-119168

Published

Nomad

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "platforms": [
                        "64 bit",
                        "32 bit",
                        "x86",
                        "ARM",
                        "MacOS",
                        "Windows",
                        "Linux"
                    ],
                    "product": "Nomad",
                    "repo": "https://github.com/hashicorp/nomad",
                    "vendor": "HashiCorp",
                    "versions": [
                        {
                            "lessThan": "2.1.1",
                            "status": "affected",
                            "version": "0.5.3",
                            "versionType": "semver"
                        }
                    ]
                }

Nomad Enterprise

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "platforms": [
                        "64 bit",
                        "32 bit",
                        "x86",
                        "ARM",
                        "MacOS",
                        "Windows",
                        "Linux"
                    ],
                    "product": "Nomad Enterprise",
                    "repo": "https://github.com/hashicorp/nomad",
                    "vendor": "HashiCorp",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "1.11.12",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "1.10.18",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "2.1.0",
                            "status": "affected",
                            "version": "0.5.3",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON