The vulnerability involves a symlink following flaw that occurs when Nomad dispatch payloads and executor log writes are performed. It allows a malicious workload to write files outside its allocated directory, potentially overwriting critical agent files. The flaw is categorized as a classic path traversal weakness (CWE‑59), and if the Nomad client agent runs with root privileges, it can lead to arbitrary code execution on the client host.

HashiCorp Nomad and HashiCorp Nomad Enterprise are affected. All Nomad releases before 2.1.0 are vulnerable, and for Nomad Enterprise the vulnerable versions are those prior to 2.1.0, 1.11.12, and 1.10.18. Updates to the respective fixed releases eliminate the issue.

The CVSS score of 8.4 denotes a high severity vulnerability. Although an EPSS score is not available, the lack of mitigation indicates that exploitation is plausible in environments where the Nomad agent runs as root and accepts malicious dispatch payloads. The flaw is not listed in CISA's KEV catalog, suggesting no confirmed large‑scale exploitation yet, but the high CVSS and easy attack path raise significant risk. The likely attack vector is a malicious or compromised workload submitting a payload containing a symlink that points outside its allocation directory; the attacker must also have the ability to deploy workloads on a Nomad client running as root.