HashiCorp Nomad vulnerable to symlink attack
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-6959US | — | — | ||
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vuln… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://discuss.hashicorp.com/t/hcsec-2026-14-nomad-arbitrary-file-read-write-on-client-host-through-symlink-attack/77416WEB
- https://github.com/hashicorp/nomadPACKAGE
- https://github.com/hashicorp/nomad/commit/2a09fd62c23880ff306499ae03fe64628d82a23fWEB
- https://github.com/hashicorp/nomad/releases/tag/v2.0.1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-6959ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan