Executive brief
HashiCorp Nomad is a workload orchestrator used to deploy and manage applications across infrastructure. A vulnerability in how it handles task logs allows a user with permission to run tasks to manipulate file links (symlinks) to gain unauthorized access to the host server's filesystem. This could allow an attacker to read or modify sensitive system files, potentially compromising the security of the entire server hosting the workloads.
Technical details
A symlink attack exists in HashiCorp Nomad's logging mechanism (logmon). Task drivers that implement filesystem isolation share a directory for logs, typically bind-mounted from the host. An attacker with 'job run' privileges can replace the named pipe (FIFO) or the logs subdirectory with a symlink. When the Nomad 'logmon' process (running in the host mount namespace) restarts or attaches to these files, it follows the symlinks, allowing the attacker to read or write arbitrary files on the host with the privileges of the Nomad process user. The fix involves using *os.Root to prevent symlink traversal and mounting the logs directory as read-only for isolated tasks.
Affected products
- HashiCorp Nomad 0.9 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10
- HashiCorp Nomad Enterprise 0.9 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched: Fixed in 2.0.1, 1.11.5, and 1.10.11