CVE-2026-8052
published 2026-05-12CVE-2026-8052: HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a…
PriorityP427medium6CVSS 3.1
AVLACLPRHUINSCCNIHAN
EPSS
0.13%
2.9th percentile
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | hashicorp_nomad-driver-exec2 | >= 0 < 0.1.2 | 0.1.2 |
| hashicorp | shared_library | >= 0.1.0 < 0.1.2 | 0.1.2 |
CVSS provenance
nvdv3.16.0MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
ghsa6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wqwc-x3rc-2xw6: HashiCorp Nomad’s exec2 task driver prior to 0
ghsa_unreviewed·2026-05-12·CVSS 6.0
CVE-2026-8052 [MEDIUM] CWE-59 GHSA-wqwc-x3rc-2xw6: HashiCorp Nomad’s exec2 task driver prior to 0
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
GHSA
HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack
ghsa·2026-05-12·CVSS 6.0
CVE-2026-8052 [MEDIUM] CWE-59 HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack
HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
VulDB
HashiCorp Shared library up to 0.1.1 link following
vuldb·2026-05-12
CVE-2026-8052 [CRITICAL] HashiCorp Shared library up to 0.1.1 link following
A vulnerability, which was classified as critical, was found in HashiCorp Shared library up to 0.1.1. The affected element is an unknown function. Executing a manipulation can lead to link following.
This vulnerability appears as CVE-2026-8052. The attack requires local access. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published