Nomad allocation data migration may allow host directory permission modification via symlink following
Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7 are affected when sticky ephemeral disks are used. Fixed in Nomad 2.1.1, Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.1.1, 1.10.18
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HashiCorp Nomad and Nomad Enterprise are affected, where a malicious workload could abuse symlink handling during allocation data migration on the same client to change permissions and ownership of host directories. This could allow unauthorized access to or modification of host files, potentially leading to privilege escalation.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- HashiCorp Nomad
From 0.5.3 · fixed in 2.1.1
- HashiCorp Nomad Enterprise
From 0.5.3 · fixed in 1.10.18
References 1
Questions about CVE-2026-119168
What does this mean?
During allocation data migration, a malicious workload can change the permissions and ownership of host directories. This may give it access to host data, let it modify host files, and allow privilege escalation. On clients running as root, the changes could grant unauthorized access to host directories.Source: discuss.hashicorp.com
Am I affected, and how do I check?
Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7 are affected, with the issue introduced from version 0.5.3. It requires sticky ephemeral disk behavior to be in use and a replacement allocation to be placed on the same client. Check your Nomad version with the nomad version command and check whether your jobs use sticky ephemeral disks.Source: discuss.hashicorp.com
What should I do about it?
Upgrade to Nomad 2.1.1, or to Nomad Enterprise 2.1.0, 1.11.12, or 1.10.18, depending on your edition and release line.Source: discuss.hashicorp.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data