Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-7474

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

VectorNETWORK

PublishedMay 12, 2026, 20:16

Published Bysecurity@hashicorp.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/hashicorp/nomad(Go)01.11.0-rc.1.0.20260511152149-cd7240c4099aN/A

References

https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417

Weakness Type

CWE-22

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK