---
id: CVE-2026-119168
title: >-
  Nomad allocation data migration may allow host directory permission
  modification via symlink following
summary: >-
  HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following
  during same-client allocation data migration that may allow a malicious
  workload to change permissions and ownership of host directories. This could
  allow unauthori…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-59
vendor: HashiCorp
product: Nomad
affected:
  - Nomad >= 0.5.3 < 2.1.1
  - nomad_enterprise >= 0.5.3 < 2.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T17:19:36.166956Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:19:47.361Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119168'
references:
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931
tags:
  - cve.org
epss: 0.00134
epssPercentile: 0.02942
ingestedAt: '2026-11-05T16:24:31.216Z'
---

## Overview

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

## Affected

- `Nomad >= 0.5.3 < 2.1.1`
- `nomad_enterprise >= 0.5.3 < 2.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.