CVE-2026-6959— Nomad vulnerable to arbitrary file read/write on client host through symlink attack
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HashiCorp | Nomad | 0.9.0< 2.0.1 | affected |
| HashiCorp | Nomad Enterprise | 0.9.0< 2.0.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6959
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nomad vulnerable to arbitrary file read/write on client host through symlink attack
Source: NVD (National Vulnerability Database)
Vulnerability Description
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: NVD (National Vulnerability Database)
Vulnerability Title
HashiCorp Nomad和HashiCorp Nomad Enterprise 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Nomad和HashiCorp Nomad Enterprise都是美国HashiCorp公司的产品。HashiCorp Nomad是一个简单灵活的调度器和编排器。用于在本地和云中大规模管理容器和非容器化应用程序。HashiCorp Nomad Enterprise是一个 Nomad 软件的专业版。 HashiCorp Nomad和HashiCorp Nomad Enterprise 2.0.1之前版本存在后置链接漏洞，该漏洞源于通过符号链接攻击可能导致任意文件读取和写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Nomad | 0.9.0 ~ 2.0.1 | - | |
| HashiCorp | Nomad Enterprise | 0.9.0 ~ 2.0.1 | - |
II. Public POCs for CVE-2026-6959
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6959
请登录查看更多情报信息。
Same Patch Batch · HashiCorp · 2026-05-12 · 4 CVEs total
| CVE-2026-7474 | 8.8 HIGH | Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution |
| CVE-2026-8052 | 6.0 MEDIUM | Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through s |
| CVE-2026-5061 | 4.7 MEDIUM | Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack |
IV. Related Vulnerabilities
Same product: Nomad
- CVE-2026-7474
Nomad vulnerable to path traversal in dynamic host volume wh - CVE-2025-4922
Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To - CVE-2025-1296
Nomad Exposes Sensitive Workload Identity and Client Secret - CVE-2025-0937
Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass - CVE-2024-12678
Nomad Allocations Vulnerable To Privilege Escalation Within
Same vendor: HashiCorp
- CVE-2026-7474
Nomad vulnerable to path traversal in dynamic host volume wh - CVE-2026-8052
Nomad's exec2 task driver vulnerable to arbitrary file read/ - CVE-2026-5061
Consul-template vulnerable to sandbox path bypass in file he - CVE-2026-7776
Boundary Workers Vulnerable to Denial of Service During TLS - CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro
Same weakness: CWE-59
- CVE-2026-45539
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agen - CVE-2026-44471
gitoxide: Symlink prefix-reuse allows worktree escape during - CVE-2026-43998
vm2: NodeVM require.root bypass via symlink traversal allows - CVE-2026-44470
Claude Desktop: Local Privilege Escalation via Directory Jun - CVE-2026-44220
ciguard: discover_pipeline_files follows symlinks out of sca
V. Comments for CVE-2026-6959
No comments yet