CVE-2026-8052

HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.

Score

CVSS 3.1 6.0 Medium

Status

Deferred - security@hashicorp.com

Published

2026-05-12

Last modified

2026-10-26

Weaknesses

CWE-59

Affected products

• Shared Library (Hashicorp)

References

• https://discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-clien…