HIGH 8.8 NVD

CVE-2026-119168

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to cha

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

References

https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-ho

Published: 2026-10-29 · Source: NVD · Feed updated: 2026-10-29

This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-29 via NVD.

vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.