CVE-2026-7474

Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

Affected

HashiCorp · Nomad · Nomad Enterprise

CVSS v3.1 HASHICORP

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.66% chance of exploitation in the next 30 days, 51st percentile

Published

2026-05-12

Updated

2026-05-13

Proof-of-concept exploits (1)

• M4xSec/My-Exploits1★ · 2026-08-31

Security advisories

• advisories/GHSA-hx53-77qj-8663

References

• CVE Record
• NVD entry

Related

• CVE-2020-35749
• CVE-2022-24112
• CVE-2025-55182
• CVE-2026-18963
• CVE-2026-31431
• CVE-2026-39816