Cpe:2.3:a:hashicorp:nomad:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ahashicorpnomad/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 20:40:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHashiCorp Nomad: Symlink following privilege escalation (CVE-2026-107347)https://feed.craftedsignal.io/briefs/2026-10-hashicorp-nomad-symlink/Thu, 29 Oct 2026 20:40:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-hashicorp-nomad-symlink/HashiCorp Nomad and Nomad Enterprise contain a symlink following vulnerability that allows malicious workloads to overwrite files outside of their allocation directory, potentially resulting in root-level code execution on the host.HashiCorp Nomad and Nomad Enterprise are vulnerable to a symlink following issue during dispatch payload processing and executor log writes. An attacker with the ability to submit a job to the Nomad cluster can manipulate file paths via symlinks to escape the restricted allocation directory. If the Nomad client agent process is executing with root privileges, this vulnerability (CVE-2026-107347) facilitates local privilege escalation, allowing the attacker to write to sensitive system files and achieve arbitrary code execution.

Impact

Successful exploitation allows a malicious workload to escape its container or allocation boundary and modify arbitrary files on the host filesystem. When the Nomad agent is configured with elevated permissions (root), this results in full host compromise.

Recommendation

  • Patch affected Nomad installations immediately. Update Nomad to version 2.1.0 or later.
  • Update Nomad Enterprise instances to 2.1.0, 1.11.12, or 1.10.18.
  • Audit Nomad client agent configuration to ensure the agent is not running as root unless strictly required.
  • Review existing job specifications and submitted dispatch payloads for unauthorized path traversal or symlink usage.
]]>highadvisory