Executive brief
HashiCorp Nomad's exec2 task driver, which manages how applications run on a server, is vulnerable to a security flaw that could allow an attacker to read or write unauthorized files on the host system. By manipulating symbolic links related to application logs, a user with high-level permissions to launch tasks could gain access to sensitive system files. This could lead to the modification of system configurations or the exposure of private data on the affected server.
Technical details
The HashiCorp Nomad exec2 task driver prior to version 0.1.2 is vulnerable to a symlink attack (CWE-59) involving the named pipes (FIFOs) used for capturing stdout and stderr logs. An attacker with sufficient privileges to launch a Nomad task can manipulate these symlinks within an allocation's shared directory. Because this directory is typically a bind mount from the host, the attacker can redirect the logging process to read from or write to arbitrary files on the host filesystem with the privileges of the Nomad process user. The vulnerability is fixed in version 0.1.2.
Affected products
- HashiCorp Nomad exec2 task driver < 0.1.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: patched: Version 0.1.2 released
- 2026-05-12: advisory