EUVD-2026-29827
GHSA-wqwc-x3rc-2xw6
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
PR:H required per task submission privileges; C:H added because description confirms arbitrary file read, contradicting the NVD C:N assignment; S:C retained as exploitation escapes task sandbox to host.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
AnalysisAI
Arbitrary file read and write on the Nomad client host is achievable through a symlink attack in HashiCorp Nomad's exec2 task driver prior to version 0.1.2. An attacker operating as the Nomad process user with high local privileges can exploit CWE-59 link-following behavior to redirect file operations outside the intended task sandbox, reading or writing arbitrary files on the underlying host. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the integrity impact is significant given the scope change to the host system.
Technical ContextAI
The exec2 task driver is a plugin for HashiCorp Nomad, a workload orchestration platform, responsible for executing tasks in a sandboxed environment on client nodes. CWE-59 (Improper Link Resolution Before File Access - 'Link Following') describes a class of vulnerabilities where software resolves symbolic links without sufficient validation, allowing an attacker to redirect file operations to unintended filesystem paths. In this case, the exec2 driver fails to safely dereference symlinks during task execution, permitting the Nomad process user to traverse outside the task's designated filesystem scope. The affected CPE is cpe:2.3:a:hashicorp:shared_library:*:*:*:*:*:*:*:*, covering exec2 task driver versions from 0.1.0 up to but not including 0.1.2. The S:C (Scope Changed) metric in the CVSS vector confirms impact extends beyond the task isolation boundary to the client host.
RemediationAI
The primary fix is to upgrade the exec2 task driver to version 0.1.2, which HashiCorp has confirmed resolves the symlink vulnerability. Details are available in the HashiCorp security advisory at https://discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-client-host-through-symlink-attack/77415. If an immediate upgrade is not feasible, a compensating control is to disable the exec2 task driver entirely and substitute an alternative driver such as the built-in exec or docker drivers, though this will prevent exec2-specific task workloads from running and may require job specification changes. Additionally, applying the principle of least privilege by restricting which Nomad operators or jobs can submit exec2 tasks reduces the pool of potential attackers, since PR:H is required. Enforce strict access controls on Nomad ACL policies to limit who can submit tasks using this driver.
More in Shared Library
View allSame weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today