CVE-2026-8052 Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
Attackers can read or write arbitrary files on the client host via symlink attacks in the Nomad exec2 task driver.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8052?
CVE-2026-8052 is a medium-severity path traversal vulnerability in HashiCorp Shared library, published on 12 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
Weakness: CWE-59
Which versions are affected by CVE-2026-8052?
3 open source packages ship an affected version, including github.com/hashicorp/nomad-driver-exec2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/nomad-driver-exec2 Go | All versions | 0.1.2 |
github.com/hashicorp/nomad-driver-exec2 Go | All versions | 0.1.2 |
github.com/hashicorp/nomad-driver-exec2 Go | All versions | 0.1.2 |
How do I fix CVE-2026-8052?
Upgrade github.com/hashicorp/nomad-driver-exec2 to 0.1.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-8052 being exploited?
There is no known exploitation of CVE-2026-8052 in the wild and no public exploit code.
Sources
Also known as GHSA-wqwc-x3rc-2xw6, GO-2026-5718, UBUNTU-CVE-2026-8052.