What’s Vulnerable › Vulnerabilities
CVE-2026-8052: Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
- Severity: medium (CVSS 6.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-12 · updated 2026-10-26
- Weakness: CWE-59
Description
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
Affected products
- HashiCorp Shared library: from 0.1.0 before 0.1.2 — fixed in 0.1.2
How to fix
Upgrade to a fixed version: HashiCorp Shared library 0.1.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-8052 or the next vulnerability affects your stack