CVE-2026-8052 Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack

🗓️ 12 May 2026 19:09:15Reported by HashiCorpType

CVE-2026-8052: Nomad exec2 driver before 0.1.2 allows arbitrary file read and write on the client via a symlink; fixed in 0.1.2.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2026-8052	12 May 202619:09	–	attackerkb
BDU FSTEC	The vulnerability of the exec2 task driver for Nomad, related to the incorrect definition of symbolic links before accessing files, allows a malicious actor to gain access to and read/write arbitrary files.	18 May 202600:00	–	bdu_fstec
Circl	CVE-2026-8052	12 May 202623:50	–	circl
CNNVD	HashiCorp Nomad 后置链接漏洞	12 May 202600:00	–	cnnvd
CVE	CVE-2026-8052	12 May 202619:09	–	cve
Cvelist	CVE-2026-8052 Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack	12 May 202619:09	–	cvelist
IBM Security Bulletins	Security Bulletin: Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack	12 May 202620:17	–	ibm
EUVD	EUVD-2026-29827	12 May 202621:31	–	euvd
Github Security Blog	HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack	12 May 202621:31	–	github
HashiCorp Security Advisories	Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack	12 May 202618:46	–	hashicorp

Source	Link
discuss	www.discuss.hashicorp.com/t/hcsec-2026-13-nomads-exec2-task-driver-vulnerable-to-arbitrary-file-read-write-on-client-host-through-symlink-attack/77415

12 May 2026 19:09Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16

EPSS0.00129

SSVC