HashiCorp Nomad symlink escape and Boundary SSRF disclosed
Original title: HashiCorp security advisory (AV26-1106)
Nomad dispatch writes can leave the allocation directory via symlinks, and Boundary has SSRF in its Vault credential store.
Canada's Cyber Centre published AV26-1106 on October 30, 2026, citing HashiCorp vulnerabilities current as of October 29. Nomad and Nomad Enterprise builds before the listed releases are affected, as are Boundary before 1.0.2 and Boundary Enterprise before 1.0.2 and 0.21.6. HCSEC-2026-52 says Nomad dispatch payload writes can escape the allocation directory through symlinks. HCSEC-2026-54 says Boundary is vulnerable to server-side request forgery in the Vault credential store. The centre urges administrators to review the links and apply updates.
Unconfirmed: The notice does not state whether either issue is being exploited or assign CVE identifiers.
- Nomad is affected prior to 2.1.0.
- Nomad Enterprise is listed prior to 2.1.0, 1.11.12, and 1.10.18.
- Boundary is affected prior to 1.0.2.
- Boundary Enterprise is listed prior to 1.0.2 and 0.21.6.
Impact: Allocation-directory escape via symlinks and Vault-store SSRF
| Product | Affected | Fixed in |
|---|---|---|
| HashiCorp Nomad | Prior to 2.1.0 | 2.1.0 |
| HashiCorp Nomad Enterprise | Prior to 2.1.0, 1.11.12, and 1.10.18 | 2.1.0, 1.11.12, and 1.10.18 |
| HashiCorp Boundary | Prior to 1.0.2 | 1.0.2 |
| HashiCorp Boundary Enterprise | Prior to 1.0.2 and 0.21.6 | 1.0.2 and 0.21.6 |
- 1.Review HCSEC-2026-52 and HCSEC-2026-54 and apply the listed Nomad and Boundary updates.
- Vendors
- HashiCorp
- Organizations
- Canadian Centre for Cyber Security
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-1106 Date: October 30, 2026 As of October 29, 2026, HashiCorp is affected by vulnerabilities in the following products: Nomad Prior to 2. 1. 0 Nomad Enterprise Prior to 2.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.