Quick answers
- Is CVE-2026-107347 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107347 being exploited in the wild.
- How severe is CVE-2026-107347?
- High severity, with a CVSS score of 8.4, published 29 October 2026.
- Which products and versions are affected?
- HashiCorp Nomad up to 2.0.7; HashiCorp Nomad Enterprise up to 2.0.7.
- Is there a fix for CVE-2026-107347?
- Yes: fixed in Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107347 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-107347?
- Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18
Technical details
The vulnerability is a symlink following issue in Nomad's handling of dispatch payload writes and executor log writes within the allocation working directory. An authenticated attacker with job submission privileges can place symbolic links in the allocation directory to redirect writes to arbitrary host file paths, gaining the file modification privileges of the client agent process. The exec and java drivers on Linux are explicitly affected by the executor log component.
Affected products
- HashiCorp Nomad up to 2.0.7
- HashiCorp Nomad Enterprise up to 2.0.7
Timeline
- 2026-10-29: disclosed