# HCSEC-2026-53 - Nomad allocation data migration may allow host directory permission modification via symlink following

**URL:** <https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931>\
**Category:** Security\
**Tags:** security-nomad\
**Created:** [October 29, 2026, 6:12pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931 "2026-10-29T18:12:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![james.warren](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/james.warren/32/44042_2.png) [@james.warren](https://discuss.hashicorp.com/u/james.warren)\
**Post date:** [October 29, 2026, 6:12pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931/1 "2026-10-29T18:12:11Z")

</div>

**Bulletin ID:** HCSEC-2026-53

**Affected Products / Versions:** Nomad up to 2.1.0 and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

**Publication Date:** October 29, 2026

**Summary**

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

**Background**

Nomad’s sticky ephemeral disk ([ephemeral\_disk block in the job specification | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/job-specification/ephemeral_disk)) feature allows task data to be reused when an allocation is replaced on the same client. Nomad moves the previous allocation’s task-local and shared data directories into the replacement allocation and prepares its task directories for use.

**Details**

During same-client allocation data migration, Nomad could preserve a task-planted symbolic link and subsequently follow it when setting directory permissions and ownership. An attacker with permission to submit and update jobs, whose workload can replace a task-local directory with a symbolic link, could cause these changes to affect a host directory outside the allocation. Exploitation requires sticky ephemeral disk behavior and a replacement allocation placed on the same client. On clients running as root, the changes could grant unauthorized access to host directories, with the impact depending on their contents and accessibility from the workload. Allocations that do not reuse data from a previous allocation are not affected by this migration issue.

**Remediation**

Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 2.1.1 or Nomad Enterprise 2.1.0, 1.11.12, or 1.10.18.

**Acknowledgement**

This issue was reported to HashiCorp by Sajda Kabir ([sajdakabir (Sajda Kabir) · GitHub](http://github.com/sajdakabir)).

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._