GitHub Advisoryadvisory · Go
GHSA-hx53-77qj-8663 HashiCorp Nomad vulnerable to a path traversal
HIGH
Official page ↗
- Aliases
- CVE-2026-7474
- Ecosystem
- Go
- Packages
- github.com/hashicorp/nomad
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-22
- Reviewed
- 2026-05-19
Affected packages
• Go github.com/hashicorp/nomad: < 1.11.0-rc.1.0.20260511152149-cd7240c4099a → fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a
Description
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Related
Alias · CVE (1)
- CVE-2026-7474 HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-7474 advisory
- https://github.com/hashicorp/nomad/commit/cd7240c4099ad33eda279924fb3a9459b162d120 web
- https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417 web
- https://github.com/hashicorp/nomad package
- https://github.com/hashicorp/nomad/releases/tag/v2.0.1 web