CVE-2026-6959 Nomad vulnerable to arbitrary file read/write on client host through symlink attack
Attackers can read or write arbitrary files on the client host via symlink attacks, requiring an upgrade to secure the Nomad process.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6959?
CVE-2026-6959 is a medium-severity path traversal vulnerability in HashiCorp Nomad, published on 12 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Weakness: CWE-59
Which versions are affected by CVE-2026-6959?
3 open source packages ship an affected version, including github.com/hashicorp/nomad.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/nomad Go | All versions | 1.11.0-rc.1.0.20260512123500-2a09fd62c238 |
github.com/hashicorp/nomad Go | All versions | 1.11.0-rc.1.0.20260512123500-2a09fd62c238 |
github.com/hashicorp/nomad Go | All versions | 1.11.0-rc.1.0.20260512123500-2a09fd62c238 |
How do I fix CVE-2026-6959?
Upgrade github.com/hashicorp/nomad to 1.11.0-rc.1.0.20260512123500-2a09fd62c238 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-6959 being exploited?
There is no known exploitation of CVE-2026-6959 in the wild and no public exploit code.
Sources
Also known as GHSA-3934-423w-4jq3, GO-2026-5076, UBUNTU-CVE-2026-6959.