Persistent workload data can quietly become a host-permission problem. CVE-2026-119168 involves Nomad's sticky ephemeral disk behavior. Under the required conditions, a malicious workload can replace its local directory with a symbolic link before migration, causing Nomad's ownership or permission changes to land on a host directory instead. The larger lesson is architectural: lifecycle operations often execute with privileges that the workload itself does not possess. Replacement, migration, cleanup, and restore paths deserve the same scrutiny as workload startup. **In practical terms, it is a good time to:** - identify jobs using sticky ephemeral disks and map the clients where replacements can occur - review policies granting both job submit and update capabilities - inspect Nomad client service privileges and filesystem access on affected Linux hosts - query auditd for unexpected chmod, chown, or related metadata changes around allocation replacements - verify file-integrity monitoring covers host directories whose ownership changes would alter access Do your security reviews examine workload migration and cleanup paths as closely as deployment paths? #LinuxSecurity #InfrastructureSecurity #IncidentResponse #DevSecOps #LinuxHardening https://linuxsecurity.com/news/security-vulnerabilities/nomad-vulnerability-host-file-writes