Nomad vulnerabilities
CVEs whose affected-version data names the Nomad package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-119168High· 8.8Nomad allocation data migration may allow host directory permission modification via symlink following
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthori…
CVE-2026-102260Medium· 4.3Nomad vulnerable to cross-namespace information disclosure in multiple endpoints
HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about object…
CVE-2026-107347High· 8.4Nomad dispatch payload writes can escape the allocation directory through symlinks
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as …