CVE-2026-8052CWE-59

Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack

Medium · published May 12, 2026

CVSS v3.1
6.0
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00172 · 6.3th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-05-12T19:09Z
EPSS history
Timeline
  • 12 MAY 19:09Z
    Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
    cvelistv5