Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
Priority MEDIUM 51CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08156 94th percentileScored 2026-11-07
Fix Fixed Nomad (HashiCorp): 2.0.1Nomad Enterprise (HashiCorp): 2.0.1+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HashiCorp | Nomad | 1.10.0 to before 2.0.1 | 2.0.1 | Patch available | CNA |
| HashiCorp | Nomad Enterprise | 1.10.0 to before 2.0.1 | 2.0.1 | Patch available | CNA |
| — | github.com/hashicorp/nomad (Go) | before 1.11.0-rc.1.0.20260511152149-cd7240c4099a | 1.11.0-rc.1.0.20260511152149-cd7240c4099a | Patch available | GHSA-hx53-77qj-8663 |
- Nomad VendorHashiCorp Affected 1.10.0 to before 2.0.1 Fixed in 2.0.1 Patch available CNA
- Nomad Enterprise VendorHashiCorp Affected 1.10.0 to before 2.0.1 Fixed in 2.0.1 Patch available CNA
- github.com/hashicorp/nomad (Go) Vendor— Affected before 1.11.0-rc.1.0.20260511152149-cd7240c4099a Fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a Patch available GHSA-hx53-77qj-8663
Remediation
- Fix · CNA Nomad (HashiCorp) Fixed in 2.0.1
- Fix · CNA Nomad Enterprise (HashiCorp) Fixed in 2.0.1
- Fix · GHSA-hx53-77qj-8663 github.com/hashicorp/nomad (Go) Fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
HashiCorp Nomad, Nomad Enterprise 2.0.1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-06091 Nomad vulnerable to arbitrary file read/write on client host through symlink attackPriority LOW 26
Timeline
- 2026-10-02 Threatist record created from CVE-2026-7474
- 2026-10-03 Alias added: GHSA-hx53-77qj-8663
- 2026-10-05 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the 90th–95th percentile
References
Other 4
- https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417
- https://github.com/hashicorp/nomad/commit/cd7240c4099ad33eda279924fb3a9459b162d120
- https://github.com/hashicorp/nomad
- https://github.com/hashicorp/nomad/releases/tag/v2.0.1
More HashiCorp vulnerabilities
- TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
- TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
- TI-2020-17753 The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root… CVSS 3.1CRITICAL 9.8
- TI-2026-13641 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
- TI-2026-13778 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
- TI-2022-19053 An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-7474 · CVE Program
- CVE-2026-7474 · NVD
- FIRST EPSS
- GHSA-hx53-77qj-8663 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences