Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: HashiCorp Nomad, Nomad Enterprise 2.1.0, 2.1.1 Clear all filters
TI-2026-82717 CVE-2026-119168 · GHSA-hwr3-7cq5-x5mf

Symlink following in Nomad lets workloads alter host permissions

Priority LOW 39

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00134 Published 2026-10-29 Fixed in 2.1.1, 2.1.0 CWE-59
TI-2026-82715 CVE-2026-107347 · GHSA-qx6c-5f28-88p2

Symlink following in HashiCorp Nomad allows writes outside allocation

Priority LOW 35

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00132 Published 2026-10-29 Fixed in 2.1.1, 2.1.0 CWE-59
TI-2026-82714 CVE-2026-102260 · GHSA-v86q-pc4q-725p

Nomad API endpoints leak cross-namespace information

Priority LOW 19

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view informa…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00176 Published 2026-10-29 Fixed in 2.1.1, 2.1.0 CWE-863