---
id: "CVE-2026-119168"
kind: "vulnerability"
aliases: ["CVE-2026-119168"]
title: "HashiCorp Nomad: symlink following lets a workload change host file permissions"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hashicorp", "infrastructure", "kubernetes", "nomad", "self-hosted"]
not_affected_if: ["fixed-version", "single-workload-hosts"]
published_at: "2026-10-29T19:17:21+00:00"
first_seen_at: "2026-10-29T19:26:47+00:00"
updated_at: "2026-10-29T19:27:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119168", "first_seen_at": "2026-10-29T19:26:47+00:00"}]
---

# HashiCorp Nomad: symlink following lets a workload change host file permissions

Nomad can follow a symlink during allocation data migration on the same client, so a malicious workload can change the permissions and ownership of host directories. An attacker can use this to reach or modify host files and possibly escalate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Nomad version on each client with `nomad version`
- Confirm whether the cluster runs Nomad Enterprise and which release line it is on

## Fix

- Nomad: `2.1.0`
- Nomad Enterprise: `2.1.0`, `1.11.12`, `1.10.18`

## Timeline

- 2026-10-29T19:26:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119168

## From the sources

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_