CVE-2026-8052: 
Nomad vulnerability analysis and mitigation

CVE-2026-8052 is a symlink attack vulnerability in HashiCorp Nomad's exec2 task driver that allows arbitrary file read and write on the client host. It affects all versions of the github.com/hashicorp/nomad-driver-exec2 Go module prior to 0.1.2. The vulnerability was published on May 12, 2026, and patched in exec2 task driver version 0.1.2. It carries a CVSS v3.1 base score of 6.0 (Medium) (GitHub Advisory, HashiCorp Advisory).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'), where the exec2 task driver fails to properly validate or resolve symbolic links before performing file operations. An attacker with high privileges on the Nomad system can craft a symlink within a task's working directory that points to an arbitrary file on the client host; when the driver follows the symlink, it reads or writes the target file using the permissions of the Nomad process user. The attack vector is local, requires high privileges, and has low complexity with no user interaction needed, but the scope changes because the impact extends beyond the task sandbox to the underlying client host (GitHub Advisory, HashiCorp Advisory).

A privileged Nomad operator or administrator can read and write arbitrary files on the client host with the permissions of the Nomad process user, potentially modifying critical system or application configuration files, injecting malicious content, or exfiltrating sensitive data. There is no direct confidentiality impact scored (C:N), but integrity is rated High (I:H), reflecting the ability to tamper with host-level files outside the task sandbox. In environments where the Nomad process runs with elevated OS privileges, this could facilitate privilege escalation or persistent compromise of the client node (GitHub Advisory, HashiCorp Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires high privileges on the Nomad system, limiting the attack surface to trusted administrators or operators who have been compromised or act maliciously. The EPSS score is approximately 0.021–0.027%, placing it in the 8th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain privileged Nomad access: Obtain operator or administrator credentials on a Nomad cluster that uses the exec2 task driver (versions prior to 0.1.2).
2. Submit a malicious job: Define a Nomad job using the exec2 task driver that includes a task with a crafted symlink in its working directory or artifact, pointing to a sensitive file on the client host (e.g., /etc/passwd, SSH authorized keys, or application configuration files).
3. Trigger file operation: Cause the exec2 driver to perform a file read or write operation that follows the symlink — for example, by placing the symlink at a path the driver accesses during task setup, execution, or artifact handling.
4. Achieve arbitrary file read/write: The driver resolves the symlink and operates on the target host file using the Nomad process user's permissions, allowing the attacker to read sensitive data or overwrite critical files.
5. Escalate or persist: Use the ability to write arbitrary files to plant backdoors, modify cron jobs, or alter service configurations on the client host for persistence or privilege escalation (GitHub Advisory, HashiCorp Advisory).

• File System: Unexpected symbolic links within Nomad task working directories (e.g., under /var/lib/nomad/alloc/) pointing to sensitive host paths such as /etc/, /root/, or application config directories.
• File System: Unexplained modifications to critical host files (e.g., /etc/passwd, /etc/cron.d/, SSH authorized_keys) with timestamps correlating to Nomad task execution.
• Logs: Nomad client logs showing exec2 task driver file operations on paths outside expected task allocation directories.
• Process: Nomad process user (e.g., nomad) accessing or modifying files outside of /var/lib/nomad/ or configured data directories, visible via auditd or file integrity monitoring tools.

Upgrade the HashiCorp Nomad exec2 task driver to version 0.1.2 or later, which contains the fix for this vulnerability (GitHub Advisory, HashiCorp Advisory). As interim mitigations, restrict high-privilege access to the Nomad system to only trusted administrators, and review and audit file operations performed by privileged users. Deploying file integrity monitoring on Nomad client hosts can help detect unauthorized file modifications.

HashiCorp published an official security advisory (HCSEC-2026-13) disclosing the vulnerability and the fix on May 12, 2026 (HashiCorp Advisory). The vulnerability received routine coverage from automated CVE tracking services and security aggregators, with no notable researcher commentary or significant community discussion observed. Red Hat also tracked the CVE as of June 2026 (Red Hat CVE).