{"id":"CVE-2026-119168","kind":"vulnerability","aliases":["CVE-2026-119168"],"related":[],"title":"HashiCorp Nomad: symlink following lets a workload change host file permissions","description":"HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.","summary":"Nomad can follow a symlink during allocation data migration on the same client, so a malicious workload can change the permissions and ownership of host directories. An attacker can use this to reach or modify host files and possibly escalate privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hashicorp","infrastructure","kubernetes","nomad","self-hosted"],"not_affected_if":["fixed-version","single-workload-hosts"],"how_to_check":"- Check the Nomad version on each client with `nomad version`\n- Confirm whether the cluster runs Nomad Enterprise and which release line it is on","fix":"- Nomad: `2.1.0`\n- Nomad Enterprise: `2.1.0`, `1.11.12`, `1.10.18`","status":"open","published_at":"2026-10-29T19:17:21+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","triaged_at":"2026-10-29T19:27:16+00:00","updated_at":"2026-10-29T19:27:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T19:27:16Z","model":"claude-haiku-5-5","output":{"fix":"- Nomad: `2.1.0`\n- Nomad Enterprise: `2.1.0`, `1.11.12`, `1.10.18`","reach":"local","title":"HashiCorp Nomad: symlink following lets a workload change host file permissions","impact":"high","summary":"Nomad can follow a symlink during allocation data migration on the same client, so a malicious workload can change the permissions and ownership of host directories. An attacker can use this to reach or modify host files and possibly escalate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nomad","hashicorp","self-hosted","kubernetes"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"malicious workload modifies host files and escalates privileges","analyst_note":"Confirm which Nomad configurations trigger same-client allocation data migration and whether a default install is exposed.","how_to_check":"- Check the Nomad version on each client with `nomad version`\n- Confirm whether the cluster runs Nomad Enterprise and which release line it is on","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","single-workload-hosts"],"who_is_affected":"Teams running Nomad or Nomad Enterprise clients where workloads share a host and allocation data migration runs between clients. Clusters on a fixed release line or without multi-workload client hosts are less exposed. The sources do not state which default configurations trigger the migration path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4190,"output_tokens":557,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119168':14A,17A,119C '-2026':13A,16A,118C '1.10.18':131C '1.11.12':129C '2.1.0':124C,128C 'access':101C 'alloc':31B,80C 'allow':85C,99C 'attack':52B 'chang':8A,43B,90C 'client':37B,79C 'could':98C 'cve':12A,15A,117C 'data':32B,81C,104C 'directori':50B,96C 'enterpris':70C,127C 'escal':64B,114C 'file':10A,61B,109C 'fix':121C 'follow':4A,27B,75C 'hashicorp':1A,18B,66C 'host':9A,24B,49B,60B,95C,103C,108C 'infrastructur':19B 'kubernet':20B 'lead':111C 'let':5A 'malici':40B,87C 'may':84C 'migrat':33B,82C 'modif':106C 'modifi':59B 'nomad':2A,21B,25B,67C,69C,123C,126C 'ownership':47B,93C 'permiss':11A,45B,91C 'possibl':63B 'potenti':110C 'privileg':65B,113C 'reach':57B 'same-cli':77C 'self':23B 'self-host':22B 'symlink':3A,29B,74C 'unauthor':100C 'use':54B 'vulner':72C,116C 'workload':7A,41B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams running Nomad or Nomad Enterprise clients where workloads share a host and allocation data migration runs between clients. Clusters on a fixed release line or without multi-workload client hosts are less exposed. The sources do not state which default configurations trigger the migration path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T19:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119168","severity":null,"published_at":"2026-10-29T19:17:21+00:00","modified_at":"2026-10-29T19:17:21+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","fetched_at":"2026-10-29T19:26:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}