Threats tagged 'ghsa-qx6c-5f28-88p2'

HashiCorp Nomad and Nomad Enterprise contain a vulnerability involving symlink following during dispatch payload and executor log writes. This flaw allows a malicious workload to modify files outside its allocated directory. If the Nomad client agent runs with root privileges, exploitation could lead to root code execution on the client host. The vulnerability is tracked as CVE-2026-107347 and has a high severity rating with a CVSS score of 8.4. Fixed versions include Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.