A vulnerability in HashiCorp Nomad’s exec2 task driver allows an attacker who can submit a task to read or modify any file on the client host as the Nomad process user. The flaw arises from insufficient validation of symlink targets, letting the task write through a symlink to overwrite system files or read sensitive data. This capability enables a compromise of confidentiality, integrity, and potentially availability of the client system.

HashiCorp Nomad exec2 task driver versions before 0.1.2 are affected. The vulnerability applies to installations that use the exec2 driver within the Nomad agent’s shared library environment.

The vulnerability carries a CVSS base score of 6, indicating a medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack scenario requires an attacker with the ability to submit or influence a task running on the client, which may occur if malicious or compromised workloads are authorized. Because the flaw is local to the Nomad task execution context, exploitability depends on the presence and configuration of the exec2 driver and the privileges of the Nomad process.