CVE-2026-107347 Nomad dispatch payload writes can escape the allocation directory through symlinks
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-107347?
CVE-2026-107347 is a high-severity vulnerability in HashiCorp Nomad, published on 29 Oct 2026.
Official description
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Weakness: CWE-59
Which versions are affected by CVE-2026-107347?
How do I fix CVE-2026-107347?
No fix has been published for CVE-2026-107347 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107347 being exploited?
There is no known exploitation of CVE-2026-107347 in the wild and no public exploit code.
Sources
Also known as GHSA-qx6c-5f28-88p2.