CVE-2026-107347
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload…
- Risk score
- 50/100
- CVSS
- 8.4 v3.1
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerabi…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.4 high
References
Original description
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Last activity 29 Oct 2026. Patch Forecast updates every hour.