~ / search / GHSA-wqwc-x3rc-2xw6

GHSA-wqwc-x3rc-2xw6

HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-8052

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/nomad-driver-exec2 < 0.1.2 0.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.

References

External links from the advisory. They lead to third-party sites.