CVE-2026-6959 is a vulnerability in HashiCorp Nomad and Nomad Enterprise prior to version 2.0.1 that allows arbitrary file read and write on the client host by exploiting improper link resolution before file access (CWE-59). The attack vector involves a symlink attack that leverages the Nomad process user's privileges. The vulnerability is fixed in Nomad versions 2.0.1, 1.11.5, and 1.10.11. The CVSS 3.1 base score is 6.0 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N, indicating local attack with low complexity, requiring high privileges, no user interaction, and a scope change with impact on integrity but not confidentiality or availability.

An attacker with high privileges on the local system can exploit this vulnerability to perform arbitrary file read and write operations as the Nomad process user. This can lead to integrity violations on the client host. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are currently reported in the wild.

This vulnerability is fixed in HashiCorp Nomad versions 2.0.1, 1.11.5, and 1.10.11. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is confirmed by the vendor advisory information embedded in the description. No additional mitigation steps are indicated.