CVE-2026-119168

    Dashboard / Vulnerabilities / CVE-2026-119168

    CVE-2026-119168

    Published: 29 Oct 2026Last Modified: 4 Nov 2026

    Summary: Nomad allocation data migration may allow host directory permission modification via symlink following

    Details: HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

    References: https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119168.json, https://nvd.nist.gov/vuln/detail/CVE-2026-119168, https://github.com/hashicorp/nomad

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cb8ca0744708b0270188be2fd613e95a8504140c
    Fixed -d0f21042997689c7690421ede8849be694e2ce46

    Affected versions

    v2.1.0-rc.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119168 | CVE-DB