CVE-2026-119168: Nomad allocation data migration may allow host directory permission modification via symlink following
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Other sources
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
— NVD
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Nomadto a version that resolves this vulnerability.Fixed in 2.1.1 - Upgrade
Upgrade
HashiCorp Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
HashiCorp Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.11.12 - Upgrade
Upgrade
HashiCorp Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.10.18
Event History
Frequently Asked Questions
What conditions are required for exploitation?
Exploitation requires a malicious workload and same-client allocation data migration. The CVSS vector indicates local access and low privileges are required; no user interaction is required.
Which systems are most exposed?
Nomad clients that perform same-client allocation data migrations for workloads that may be malicious are exposed. Successful exploitation may let the workload alter ownership and permissions of host directories, potentially enabling access to host data, host-file modification, or privilege escalation.
Which releases contain a fix?
Nomad Enterprise fixes are identified as 2.1.0, 1.11.12, and 1.10.18. The supplied advisory data is inconsistent for open-source Nomad, identifying both 2.1.0 and 2.1.1 as fixed releases; verify the vendor advisory before selecting the target version.