Live › vulnerability › CVE-2026-107347
Nomad and Nomad Enterprise follow symlinks when writing dispatch payloads and executor logs, so a malicious workload can modify files outside its allocation directory. If the client agent runs as root, this can lead to code execution as root on the client host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.
Teams running Nomad or Nomad Enterprise clients that execute workloads, especially where the client agent runs as root and where workloads from less-trusted sources can be scheduled. Clusters that run only trusted workloads on non-root clients face a lower risk. The sources do not describe further conditions.
No product ranges from the sources yet.
nomad version and compare it to the fixed versions.2.1.02.1.0, 1.11.12, 1.10.18Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
This page as .md · .json · in your agent: get_signal("CVE-2026-107347")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.