HCSEC-2026-52 - Nomad dispatch payload writes can escape the allocation directory through symlinks

Bulletin ID: HCSEC-2026-52 Affected Products / Versions: Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Publication Date: October 29, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Background Nomad creates an allocation working directory (Allocation Filesystems | Nomad | HashiCorp Developer) on the client host to store task files and logs. Parameterized jobs can receive dispatch payloads that Nomad writes into a task’s local directory, while some task drivers use an executor process that writes diagnostic logs within the allocation working directory. Details Nomad did not consistently prevent dispatch payload and executor log writes from following symbolic links to files outside the intended directories. An attacker able to run a workload and place symbolic links in the relevant allocation directories could redirect these writes, potentially creating, overwriting, or appending to host files with the client agent’s privileges. The dispatch payload issue requires permission to submit and dispatch jobs, while the executor log issue can affect workloads using the exec or java drivers on Linux and requires permission to submit jobs. The potential impact depends on the client agent’s privileges and the host files it can modify. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 2.1.1 or Nomad Enterprise 2.1.0, 1.11.12, or 1.10.18. Acknowledgement This issue was reported to HashiCorp by Yonghwa Lee (Theori) and Habib (Syndicat3 Security Research Team). We deeply a…