CVE-2026-6959: HashiCorp Nomad Symlink Attack Vulnerability
Summary
CVE-2026-6959: HashiCorp Nomad vulnerable to symlink attack. Affects github.com/hashicorp/nomad versions < 1.11.0-rc.1.0.20260512123500-2a09fd62c238. Fixed in 1.11.0-rc.1.0.20260512123500-2a09fd62c238. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HashiCorp Nomad is an open-source workload orchestrator designed to manage the deployment and scaling of applications across clusters. It provides features such as job scheduling, service discovery, and resource management. However, prior to version 2.0.1, Nomad is susceptible to a symlink attack that can lead to unauthorized file access and manipulation on the client host.
Vulnerability Detail
The vulnerability identified as CVE-2026-6959 allows an attacker to exploit the symlink functionality within HashiCorp Nomad. By creating symbolic links, an attacker can redirect file operations to unauthorized locations, enabling arbitrary file read and write actions as the Nomad process user. This can lead to significant security risks, including data leakage and system compromise.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0-rc.1.0.20260512123500-2a09fd62c238
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.11.0-rc.1.0.20260512123500-2a09fd62c238Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict file permissions and avoid using symlinks in sensitive areas of the file system until the package is updated. Additionally, monitoring file access logs can help detect any unauthorized attempts to exploit this vulnerability.
Conclusion
CVE-2026-6959 represents a significant security risk for users of HashiCorp Nomad prior to version 2.0.1. It is crucial to update to the latest versions to protect against potential symlink attacks that could compromise system integrity and data security.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
CVE-2026-6959 is a vulnerability in HashiCorp Nomad that allows for arbitrary file read and write operations through a symlink attack.
Versions prior to 2.0.1, including 1.11.0-rc.1.0.20260512123500-2a09fd62c238, are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2026-6959 is 6.0, indicating a moderate severity level.
If immediate updating is not possible, consider implementing strict file permissions and monitoring for any suspicious file access attempts as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
