CVE-2026-6959: HashiCorp Nomad arbitrary file read and write via symlink attack

CVE-2026-6959 · Severity: medium · CVSS 6 · Published 2026-05-12

HashiCorp Nomad is a workload orchestrator used to deploy and manage applications across infrastructure. A vulnerability in how it handles task logs allows a user with permission to run tasks to manipulate file links (symlinks) to gain unauthorized access to the host server's filesystem. This could allow an attacker to read or modify sensitive system files, potentially compromising the security of the entire server hosting the workloads.

Technologies: github.com/hashicorp/nomad (Go), HashiCorp Nomad, HashiCorp Nomad Enterprise. Vendors: Go, HashiCorp.

Quick answers

Is CVE-2026-6959 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6959 being exploited in the wild.
How severe is CVE-2026-6959?
Medium severity, with a CVSS score of 6, published 12 May 2026.
Which products and versions are affected?
github.com/hashicorp/nomad (Go) < 1.11.0-rc.1.0.20260512123500-2a09fd62c238, SEMVER:introduced=0,fixed=1.11.0-rc.1.0.20260512123500-2a09fd62c238; HashiCorp Nomad 0.9 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10, 0.9 to 2.0.0, 1.11.4, 1.10.10; HashiCorp Nomad Enterprise 0.9 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10, 0.9 to 2.0.0, 1.11.4, 1.10.10.
Is there a fix for CVE-2026-6959?
Yes. github.com/hashicorp/nomad (Go): upgrade to 1.11.0-rc.1.0.20260512123500-2a09fd62c238 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6959 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-6959?
Check whether you run github.com/hashicorp/nomad (Go), HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/hashicorp/nomad (Go): upgrade to 1.11.0-rc.1.0.20260512123500-2a09fd62c238 or later
    go get github.com/hashicorp/nomad@v1.11.0-rc.1.0.20260512123500-2a09fd62c238

Technical details

A symlink attack exists in HashiCorp Nomad's logging mechanism (logmon). Task drivers that implement filesystem isolation share a directory for logs, typically bind-mounted from the host. An attacker with 'job run' privileges can replace the named pipe (FIFO) or the logs subdirectory with a symlink. When the Nomad 'logmon' process (running in the host mount namespace) restarts or attaches to these files, it follows the symlinks, allowing the attacker to read or write arbitrary files on the host with the privileges of the Nomad process user. The fix involves using *os.Root to prevent symlink traversal and mounting the logs directory as read-only for isolated tasks.

Affected products

  • HashiCorp Nomad 0.9 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10
  • HashiCorp Nomad Enterprise 0.9 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10

Identifiers

  • CVE-2026-6959
  • GHSA-3934-423w-4jq3
  • GO-2026-5076

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory
  • 2026-05-12: patched: Fixed in 2.0.1, 1.11.5, and 1.10.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.