8.8
Élevée
CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration…
Description
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Nomad 0.5 | 0.5.3 → < 2.1.1 | 2.1.1 |
| Nomad Enterprise 0.5 | 0.5.3 → < 2.1.0 | 2.1.0 |
Autres CVE de Nomad
Les 24 CVE de Nomad →
CVE-2026-107347
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes…
8.4
Élevée
CVE-2026-102260
HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API…
4.3
Moyenne
CVE-2026-14896
HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host…
4.2
Moyenne
CVE-2026-14891
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job…
8.7
Élevée