CVE-2026-7474 — Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution

CVE-2026-7474

Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution PUBLISHED

Description (CNA)

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Nomad	affected 1.10.0 before 2.0.1
HashiCorp / Nomad Enterprise	affected 1.10.0 before 2.0.1

CWE

CWE-22

References

https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.