HashiCorp Nomad CVE-2026-107347

Exploitation requires the attacker to be able to run a workload on a Nomad client - specifically a parameterized/dispatch job that writes a dispatch payload, or any workload producing executor logs - and to place a symlink inside its own allocation directory that Nomad then follows during those writes. Escalation to code execution as root is conditioned on the Nomad client agent running as root on the host (a common deployment mode). Limiting factors: the attack vector is local (AV:L) - there is no remote unauthenticated path; the attacker needs low-level privileges to submit/dispatch a job (PR:L), so the realistic risk concentrates in multi-tenant clusters that accept jobs from untrusted submitters; impact beyond file modification (full root RCE) depends on the agent running as root rather than as an unprivileged user.

This is a credible operational priority but not an emergency. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, 8.4) describes a local, low-privilege, no-interaction flaw whose scope changes (S:C) because writes escape the allocation sandbox onto the host - consistent with the description. The vuln.today Decision label is 'this_week', which aligns with a serious-but-not-actively-exploited issue. There is no CISA KEV listing and no EPSS score in the input, so exploitation status is 'no public exploit identified at time of analysis'; do not treat this as in-the-wild. One internal conflict is worth flagging: the vendor vector sets C:N, yet the description explicitly states the flaw 'could lead to code execution as root on the client host,' which would normally imply high confidentiality impact as well - the published vector appears to score only the file-modification primitive, not the downstream root code-execution path, so the real worst-case impact is likely higher than 8.4 suggests. The AV:L vector also means this is not remotely reachable by an unauthenticated internet attacker; the adversary must already be able to run a workload on a Nomad client, so the practical risk is highest in multi-tenant Nomad clusters where untrusted job submitters exist.

An attacker who can submit or dispatch jobs to a Nomad cluster schedules a malicious workload on a client and plants a symlink inside its allocation directory. When Nomad writes the dispatch payload or executor logs, it follows the symlink and writes to an attacker-chosen path outside the allocation; if the client agent runs as root, this file overwrite is leveraged into code execution as root on the client host. No public exploit code is identified at time of analysis, and user interaction is not required (UI:N).