Loading vulnerability details…
CVSS v3.1
6.0
EPSS
0.13%
Published
May 12, 2026
Modified
May 13, 2026
Public PoC / Exploit
All weaponized →No public PoC or exploit code indexed for this CVE.
Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:NWeaknesses (CWE)