HCSEC-2026-53 - Nomad allocation data migration may allow host directory permission modification via symlink following
// AI summary
HashiCorp Nomad and Nomad Enterprise up to 2.0.7 are vulnerable to symlink following during allocation data migration, potentially allowing a malicious workload to modify host directory permissions.
// from the source
Bulletin ID: HCSEC-2026-53 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Publication Date: October 29, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host file