HashiCorp Nomad CVE-2026-119168

Exploitation requires the attacker to control a workload (a running allocation) on a Nomad client node, and the vulnerable code path is specifically same-client allocation data migration - the feature that moves an allocation's local/sticky ephemeral data between allocations on the same client. The attacker plants a symlink within the allocation data that Nomad follows while applying ownership/permission changes, redirecting those changes to host directories. Limiting factors: this is a LOCAL vector (AV:L) requiring an existing low-privileged foothold as a scheduled workload (PR:L), so remote unauthenticated exploitation is not possible; it is most relevant to multi-tenant or untrusted-workload clusters, and deployments that do not run untrusted workloads or do not exercise allocation data migration face materially lower exposure. The precise triggering mechanics beyond symlink following during migration are not detailed in the available sources.

This is a genuine high-priority local privilege-escalation flaw, not an inflated high-CVSS issue, but its risk is scoped by the AV:L vector. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) shows that an attacker who already has a foothold as a low-privileged workload on a Nomad client can, with low complexity and no user interaction, cross the scope boundary (S:C) from the workload sandbox to the underlying host with full confidentiality, integrity, and availability impact. The input provides no EPSS score, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is supplied - only the HashiCorp vendor advisory. The vuln.today decision label is 'this_week', indicating prompt remediation rather than emergency action, which is consistent with a locally-exploitable, vendor-reported issue lacking evidence of active exploitation. The absence of EPSS/KEV/PoC signals means real-world exploitation likelihood cannot be quantified from the data; priority rests on the high technical impact and the realistic exposure of multi-tenant Nomad clusters where untrusted workloads share a client node. Net: real priority for operators running untrusted or multi-tenant workloads, lower urgency for single-tenant trusted deployments.

An attacker who can schedule a workload on a Nomad client (e.g., a tenant in a multi-tenant cluster) plants a symlink inside the allocation's data directory. When Nomad performs same-client allocation data migration, it follows the symlink and applies permission/ownership changes to attacker-chosen host directories, granting access to host data or enabling host file modification that can be leveraged for privilege escalation. No public exploit code or PoC reference is provided in the available data.