CVE-2026-7474 Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
Attackers can execute arbitrary code on client hosts via path traversal in dynamic host volumes, affecting HashiCorp Nomad deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7474?
CVE-2026-7474 is a high-severity path traversal vulnerability in HashiCorp Nomad, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Weakness: CWE-22
Which versions are affected by CVE-2026-7474?
3 open source packages ship an affected version, including github.com/hashicorp/nomad.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/nomad Go | All versions | 1.11.0-rc.1.0.20260511152149-cd7240c4099a |
github.com/hashicorp/nomad Go | All versions | 1.11.0-rc.1.0.20260511152149-cd7240c4099a |
github.com/hashicorp/nomad Go | All versions | 1.11.0-rc.1.0.20260511152149-cd7240c4099a |
How do I fix CVE-2026-7474?
Upgrade github.com/hashicorp/nomad to 1.11.0-rc.1.0.20260511152149-cd7240c4099a or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-7474 being exploited?
There is no known exploitation of CVE-2026-7474 in the wild and no public exploit code.
Sources
Also known as GHSA-hx53-77qj-8663, GO-2026-5445, UBUNTU-CVE-2026-7474.