Nomad dispatch payload writes can escape the allocation directory through symlinks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.1.0, 1.10.18
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HashiCorp Nomad and Nomad Enterprise are affected by this vulnerability, which allows a malicious workload to write files outside its allocation directory by following symlinks. If the Nomad client agent runs as root, an attacker could use this to execute code as root on the client host.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- HashiCorp Nomad
From 0.3.0 · fixed in 2.1.0
- HashiCorp Nomad Enterprise
From 0.3.0 · fixed in 1.10.18