Nomad exec2 driver CVE-2026-8052

Exploitation requires local access to the Nomad client with high privilege level (PR:H per the CVSS vector), specifically the ability to submit or control exec2 task definitions on the target Nomad client node. The exec2 task driver plugin must be installed and enabled in the Nomad client configuration - deployments not using exec2 are not at risk. Exploitation is not automatable (SSVC: Automatable: no) and is not triggered remotely without first obtaining Nomad operator-level access. Limiting factors include the requirement for high privilege (PR:H), local attack vector (AV:L), and the non-default nature of the exec2 plugin, which must be explicitly deployed and configured. The absence of remote attack capability and the high privilege threshold substantially reduce the realistic attacker population.

The CVSS base score of 6.0 (Medium) reflects a local attack vector (AV:L), low attack complexity (AC:L), and high privilege requirement (PR:H), which substantially limits the realistic attack surface. The Scope:Changed metric (S:C) elevates concern because successful exploitation escapes the task sandbox boundary to affect the broader host. EPSS sits at just 0.02% (6th percentile), consistent with SSVC's assessment of exploitation status as 'none' and technical impact as 'partial.' There is no CISA KEV listing and no POC identified. One notable discrepancy: the CVSS vector records C:N (no confidentiality impact), yet the vulnerability description explicitly includes arbitrary file read - which implies confidentiality impact of at least C:H. Security teams should treat the C:N assignment with caution and assume file read is realistically achievable. Overall, real-world risk is constrained by the requirement for high local privileges and direct access to the Nomad client; this is not a remotely triggerable, unauthenticated vulnerability.

A Nomad operator or malicious job specification with sufficient privileges to submit exec2 tasks on a client node creates a symbolic link within the task's writable directory that points to a sensitive file on the host, such as /etc/shadow or an SSH private key. When the exec2 driver processes file operations without resolving the symlink safely, it reads or overwrites the target host file as the Nomad process user, bypassing the task's intended filesystem isolation. No public exploit code has been identified, meaning exploitation likely requires manual crafting of a malicious task definition.