CVE-2026-107347: Nomad dispatch payload writes can escape the allocation directory through symlinks
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Other sources
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
— NVD
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Nomadto a version that resolves this vulnerability.Fixed in 2.1.1 - Upgrade
Upgrade
HashiCorp Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
HashiCorp Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.11.12 - Upgrade
Upgrade
HashiCorp Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.10.18
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs the ability to run or control a malicious workload. The vulnerability is triggered through symlink following during dispatch payload or executor log writes.
When could this result in host-level root code execution?
The malicious workload may modify files outside its allocation directory. If the Nomad client agent runs as root, this could lead to code execution as root on the client host.
Which releases are reported as fixed?
Nomad Enterprise fixes are listed as 2.1.0, 1.11.12, and 1.10.18. The provided data is inconsistent for the Nomad community release, listing both 2.1.0 and 2.1.1 as the fixed version; verify the applicable advisory before selecting an upgrade target.