# CVE-2026-119168: HashiCorp Nomad symlink following in allocation data migration

Source: https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119168 · Severity: high · CVSS 8.8 · Published 2026-10-29

HashiCorp Nomad is a container orchestration and job scheduling platform that manages workload deployment across infrastructure. A malicious workload can exploit symlink handling during data migration to change permissions and ownership of host directories, potentially gaining unauthorized access to sensitive host data or enabling privilege escalation when Nomad runs as root.

Technologies: [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad), [HashiCorp Nomad Enterprise](https://junglewise.ai/threats/technologies/nomad-enterprise). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-119168 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119168 being exploited in the wild.

**How severe is CVE-2026-119168?** High severity, with a CVSS score of 8.8, published 29 October 2026.

**Which products and versions are affected?** HashiCorp Nomad up to 2.0.7; HashiCorp Nomad Enterprise up to 2.0.7.

**Is there a fix for CVE-2026-119168?** Yes: fixed in Nomad 2.1.0; Nomad Enterprise 2.1.0, 1.11.12, 1.10.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119168 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-119168?** Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Nomad 2.1.0; Nomad Enterprise 2.1.0, 1.11.12, 1.10.18

## Technical details

The vulnerability exists in Nomad's sticky ephemeral disk feature during same-client allocation data migration. An attacker with job submission privileges can plant a symbolic link in task-local directories; when Nomad migrates data to a replacement allocation on the same client and applies permission/ownership changes, it follows the symlink and modifies host directories outside the allocation sandbox. This requires the sticky ephemeral disk feature to be in use and a replacement allocation on the same client.

## Affected products

- HashiCorp Nomad up to 2.0.7
- HashiCorp Nomad Enterprise up to 2.0.7

## Timeline

- 2026-10-29: disclosed

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931](https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931)

## Related threats

- [HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross)
- [HashiCorp Nomad authorization bypass in dynamic host volumes](https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes)
- [HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver)
- [HashiCorp Nomad authorization bypass in Docker task driver host namespaces](https://junglewise.ai/threats/cve-2026-14373-hashicorp-nomad-authorization-bypass-in-docker-task-driver-host)