CVE-2026-107347

HighCVSS 8.4/10Last modified Oct 30, 2026

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
HashiCorp	Nomad	>= 0.3.0, < 2.1.1
HashiCorp	Nomad Enterprise	>= 0.3.0, < 2.1.0

References

https://discuss.hashicorp.com/t/hcsec-2026-52-nomad-dispatch-payload-writes-can-escape-the-allocation-directory-through-symlinks/77930

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1073485.9Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a CVE-2026-1073497.5An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage CVE-2026-107357.5Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for Wo CVE-2026-1073508.8Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to CVE-2026-1073527.7Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited que CVE-2026-1073536.5traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution th CVE-2026-1073568.8U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload CVE-2026-1073596.5Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.CVE-2026-107364.9The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in CVE-2026-1073609.6A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through CVE-2026-1073614.2The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHos CVE-2026-1073627.1The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the res