# CVE-2026-107347: HashiCorp Nomad symlink following in dispatch payload and executor logs

Source: https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-107347 · Severity: high · CVSS 8.4 · Published 2026-10-29

HashiCorp Nomad is a container orchestration and workload management system that runs tasks on client hosts. A malicious workload can exploit symlink handling to write files outside its intended allocation directory, potentially overwriting arbitrary host files. When the Nomad client agent runs as root, an attacker could achieve code execution on the host system.

Technologies: [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad), [HashiCorp Nomad Enterprise](https://junglewise.ai/threats/technologies/nomad-enterprise). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-107347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107347 being exploited in the wild.

**How severe is CVE-2026-107347?** High severity, with a CVSS score of 8.4, published 29 October 2026.

**Which products and versions are affected?** HashiCorp Nomad up to 2.0.7; HashiCorp Nomad Enterprise up to 2.0.7.

**Is there a fix for CVE-2026-107347?** Yes: fixed in Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107347 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107347?** Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Nomad 2.1.0, Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18

## Technical details

The vulnerability is a symlink following issue in Nomad's handling of dispatch payload writes and executor log writes within the allocation working directory. An authenticated attacker with job submission privileges can place symbolic links in the allocation directory to redirect writes to arbitrary host file paths, gaining the file modification privileges of the client agent process. The exec and java drivers on Linux are explicitly affected by the executor log component.

## Affected products

- HashiCorp Nomad up to 2.0.7
- HashiCorp Nomad Enterprise up to 2.0.7

## Timeline

- 2026-10-29: disclosed

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-52-nomad-dispatch-payload-writes-can-escape-the-allocation-directory-through-symlinks/77930](https://discuss.hashicorp.com/t/hcsec-2026-52-nomad-dispatch-payload-writes-can-escape-the-allocation-directory-through-symlinks/77930)

## Related threats

- [HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross)
- [HashiCorp Nomad authorization bypass in dynamic host volumes](https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes)
- [HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver)
- [HashiCorp Nomad authorization bypass in Docker task driver host namespaces](https://junglewise.ai/threats/cve-2026-14373-hashicorp-nomad-authorization-bypass-in-docker-task-driver-host)