CVE-2026-119168

Full vulnerability record from the local CVENow database.

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-29 19:17:21.120000

Last modified

2026-10-30 14:16:41.783000

View original CVE JSON

{
  "id": "CVE-2026-119168",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-29T19:17:21.120",
  "lastModified": "2026-10-30T14:16:41.783",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HashiCorp",
          "product": "Nomad",
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "repo": "https://github.com/hashicorp/nomad",
          "versions": [
            {
              "version": "0.5.3",
              "lessThan": "2.1.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "HashiCorp",
          "product": "Nomad Enterprise",
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "repo": "https://github.com/hashicorp/nomad",
          "versions": [
            {
              "version": "0.5.3",
              "lessThan": "2.1.0",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "1.11.12",
                  "status": "unaffected"
                },
                {
                  "at": "1.10.18",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931",
      "source": "[email protected]"
    }
  ]
}