EUVD-2026-29825
GHSA-3934-423w-4jq3
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Arbitrary file read implies C:H contrary to vendor's C:N; AV:L and PR:H confirmed by local symlink attack requiring high-privilege operator access.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
AnalysisAI
Arbitrary file read and write on Nomad client hosts is possible through a symlink attack (CWE-59) affecting HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 1.x and 2.x prior to fixed releases. A local attacker operating with high privileges - such as a Nomad operator - can plant a malicious symlink that Nomad follows without proper validation, causing the Nomad process to read or write files outside its intended scope on the host filesystem, constituting a scope change per the CVSS vector (S:C). No public exploit exists and CISA has not added this to the KEV catalog; EPSS at 0.01% (1st percentile) and SSVC exploitation status of 'none' confirm this as low active-exploitation risk despite the scope change elevating CVSS to 6.0.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access, 'Link Following') describes vulnerabilities where a program resolves a symbolic link to a file path without verifying that the resolved path is within an expected or safe boundary. In Nomad's case, the Nomad client process - which runs on workload host nodes and manages task execution, artifact fetching, or log handling - follows symlinks supplied or influenced by a high-privileged local actor, allowing that actor to redirect file operations to arbitrary host paths. The CPE data (cpe:2.3:a:hashicorp:nomad and cpe:2.3:a:hashicorp:nomad_enterprise) confirms both the open-source and enterprise distributions are affected across versions 0.9.0 and later, up to but not including the fixed releases. The CVSS scope change metric (S:C) indicates that file access crosses the security boundary of the Nomad process into the broader host OS filesystem.
RemediationAI
Upgrade to HashiCorp Nomad or Nomad Enterprise version 2.0.1, 1.11.5, or 1.10.11, per the vendor's HCSEC-2026-14 advisory at https://discuss.hashicorp.com/t/hcsec-2026-14-nomad-arbitrary-file-read-write-on-client-host-through-symlink-attack/77416. The fix is confirmed available from the vendor for all three supported release branches. For organizations unable to patch immediately, the primary compensating control is enforcing strict least-privilege on the Nomad client process user and restricting which users or roles hold high-privilege (operator-level) access to Nomad client nodes - this directly limits who can plant a malicious symlink. Additionally, OS-level file integrity monitoring (e.g., auditd or inotify rules) on sensitive host paths can detect unauthorized reads or writes by the Nomad process user, providing detection rather than prevention. Note that these controls reduce risk but do not eliminate the vulnerability; patching is the definitive remediation.
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL autho
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privi
HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates use
HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. Rated critical severity (CVSS 9.8)
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using eithe
Authenticated code execution on Nomad client hosts is possible in HashiCorp Nomad and Nomad Enterprise 1.10.0 through ve
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using worklo
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenti
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to p
CVE-2025-4922 is a security vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Host namespace escape in HashiCorp Nomad and Nomad Enterprise lets an authenticated job submitter bypass the allow_privi
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today