CVE-2026-6959 Details

A vulnerability allowing arbitrary file read and write on the client host has been identified in HashiCorp Nomad and Nomad Enterprise versions prior to 2.0.1. This issue arises from a symlink attack, where an attacker can manipulate named pipe symlinks for a workload's log files. As a result, the attacker gains access to the host's filesystem with the privileges of the Nomad process user. This vulnerability is particularly concerning because it exploits the filesystem isolation of Nomad task drivers, potentially leading to unauthorized access or modification of files on the client host.

Users are advised to upgrade to Nomad 2.0.1, 1.11.5, 1.10.11, or newer.