HashiCorp fixes Nomad symlink escape and Boundary SSRF flaws in new security advisory
VULNERABILITYCanadian Centre for Cyber Securityredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
AV26-1106 lists affected versions: Nomad prior to 2.1.0; Nomad Enterprise prior to 2.1.0, 1.11.12 and 1.10.18; Boundary prior to 1.0.2; and Boundary Enterprise prior to 1.0.2 and 0.21.6. HCSEC-2026-52 is a Nomad dispatch payload write that can escape the allocation directory via symlinks, and HCSEC-2026-54 is an SSRF in the Boundary Vault credential store. The articles give no CVE IDs, severity scores or exploitation details. Defenders should review the HashiCorp advisories and upgrade to fixed releases as they become available.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Full story timeline · 2 updates
Who reported · 1 outlet
Canadian Centre for Cyber Security
Who and what is in it
Companies