Technical impact
HashiCorp Nomad and its Enterprise edition allow an attacker who can submit a job specification to create a symbolic link that points to an arbitrary file on the client host. As the Nomad service runs as the Nomad process user, the attacker can read from or overwrite files with the same privileges as that user, consuming confidentiality and integrity material on the client system. This flaw is classified as CWE‑59, a path traversal or symlink-based vulnerability that compromises the isolation boundaries between the job environment and the underlying host.
Affected Systems
HashiCorp Nomad and HashiCorp Nomad Enterprise are affected in all releases prior to 2.0.1, 1.11.5 and 1.10.11, respectively.
Risk and Exploitability
The CVSS score of 6 marks the issue as medium severity. No EPSS data has been published, and the vulnerability is not listed in the CISA KEV catalog, indicating that there is no confirmed exploit in the wild at this time. Attackers would need the ability to submit job files to a Nomad client, which typically requires local or authenticated remote access. Once a job that contains a crafted symbolic link is accepted, the Nomad agent will follow the link and perform the requested read or write while executing under its own service UID.
Github GHSA