CVE-2026-107347

Full vulnerability record from the local CVENow database.

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Severity

HIGH

CVSS score

8.4 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-29 18:17:21.940000

Last modified

2026-10-30 14:16:37.310000

View original CVE JSON

{
  "id": "CVE-2026-107347",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-29T18:17:21.940",
  "lastModified": "2026-10-30T14:16:37.310",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HashiCorp",
          "product": "Nomad",
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "repo": "https://github.com/hashicorp/nomad",
          "versions": [
            {
              "version": "0.3.0",
              "lessThan": "2.1.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "HashiCorp",
          "product": "Nomad Enterprise",
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "repo": "https://github.com/hashicorp/nomad",
          "versions": [
            {
              "version": "0.3.0",
              "lessThan": "2.1.0",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "1.11.12",
                  "status": "unaffected"
                },
                {
                  "at": "1.10.18",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 5.8
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-52-nomad-dispatch-payload-writes-can-escape-the-allocation-directory-through-symlinks/77930",
      "source": "[email protected]"
    }
  ]
}