HashiCorp Nomad: Symlink following privilege escalation (CVE-2026-107347)

HashiCorp Nomad and Nomad Enterprise are vulnerable to a symlink following issue during dispatch payload processing and executor log writes. An attacker with the ability to submit a job to the Nomad cluster can manipulate file paths via symlinks to escape the restricted allocation directory. If the Nomad client agent process is executing with root privileges, this vulnerability (CVE-2026-107347) facilitates local privilege escalation, allowing the attacker to write to sensitive system files and achieve arbitrary code execution.

Impact

Successful exploitation allows a malicious workload to escape its container or allocation boundary and modify arbitrary files on the host filesystem. When the Nomad agent is configured with elevated permissions (root), this results in full host compromise.

Recommendation

• Patch affected Nomad installations immediately. Update Nomad to version 2.1.0 or later.
• Update Nomad Enterprise instances to 2.1.0, 1.11.12, or 1.10.18.
• Audit Nomad client agent configuration to ensure the agent is not running as root unless strictly required.
• Review existing job specifications and submitted dispatch payloads for unauthorized path traversal or symlink usage.