A workload does not need root inside its own process when it can influence where a root-running scheduler writes. That is the uncomfortable part of Nomad CVE-2026-107347. A malicious workload can use a symbolic link to redirect certain Nomad client writes outside the allocation directory. The eventual impact depends heavily on the privileges of the client agent and the host path it can reach. This is a useful reminder that workload isolation and orchestrator privilege are separate security boundaries. A job may look constrained while the component preparing its files still has broad authority on the Linux host. **In practical terms, it is a good time to:** - inventory the Nomad versions running on both clients and servers, not just control-plane nodes - identify which Linux clients run the Nomad agent as root and document writable host paths - enumerate policies that grant job submit and dispatch capabilities - identify exec and Java driver workloads that can reach the affected log-writing path - use auditd or file-integrity monitoring to investigate unexpected writes to sensitive host paths Where does your threat model place the orchestrator itself: inside the workload boundary, or above it? #LinuxSecurity #DevSecOps #InfrastructureSecurity #PrivilegeEscalation #OpenSource https://linuxsecurity.com/news/security-vulnerabilities/nomad-vulnerability-host-file-writes