HashiCorp Nomad vulnerable to a path traversal

HIGH 8.8CVE-2026-7474 · GHSA-hx53-77qj-8663 · GO-2026-5445 · Published 12/05/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
github.com/hashicorp/nomad Go	`< 1.11.0-rc.1.0.20260511152149-cd7240c4099a`	`1.11.0-rc.1.0.20260511152149-cd7240c4099a`

Description

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-7474 · ADVISORY
hashicorp/nomad commit cd7240c · WEB
discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417 · WEB
hashicorp/nomad · PACKAGE
hashicorp/nomad release v2.0.1 · WEB
GitHub Advisory GHSA-hx53-77qj-8663 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free