{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nomad--2.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hashicorp:nomad:*:*:*:*:*:*:*:*","cpe:2.3:a:hashicorp:nomad_enterprise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.4,"id":"CVE-2026-107347"},{"cvss":8.8,"id":"CVE-2026-119168"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nomad (\u003c 2.1.0)","Nomad Enterprise (\u003c 2.1.0, \u003c 1.11.12, \u003c 1.10.18)","Nomad Enterprise (\u003c 1.10.18, 1.11.x \u003c 1.11.12, 2.1.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["HashiCorp"],"content_html":"\u003cp\u003eHashiCorp Nomad and Nomad Enterprise are vulnerable to a symlink following issue during dispatch payload processing and executor log writes. An attacker with the ability to submit a job to the Nomad cluster can manipulate file paths via symlinks to escape the restricted allocation directory. If the Nomad client agent process is executing with root privileges, this vulnerability (CVE-2026-107347) facilitates local privilege escalation, allowing the attacker to write to sensitive system files and achieve arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a malicious workload to escape its container or allocation boundary and modify arbitrary files on the host filesystem. When the Nomad agent is configured with elevated permissions (root), this results in full host compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected Nomad installations immediately. Update Nomad to version 2.1.0 or later.\u003c/li\u003e\n\u003cli\u003eUpdate Nomad Enterprise instances to 2.1.0, 1.11.12, or 1.10.18.\u003c/li\u003e\n\u003cli\u003eAudit Nomad client agent configuration to ensure the agent is not running as root unless strictly required.\u003c/li\u003e\n\u003cli\u003eReview existing job specifications and submitted dispatch payloads for unauthorized path traversal or symlink usage.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T20:40:58Z","date_published":"2026-10-29T20:40:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hashicorp-nomad-symlink/","summary":"HashiCorp Nomad and Nomad Enterprise contain a symlink following vulnerability that allows malicious workloads to overwrite files outside of their allocation directory, potentially resulting in root-level code execution on the host.","title":"HashiCorp Nomad: Symlink following privilege escalation (CVE-2026-107347)","url":"https://feed.craftedsignal.io/briefs/2026-10-hashicorp-nomad-symlink/"}],"language":"en","title":"CraftedSignal Threat Feed - Nomad (\u003c 2.1.0)","version":"https://jsonfeed.org/version/1.1"}