CVE-2026-7474— Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HashiCorp | Nomad | 1.10.0< 2.0.1 | affected |
| HashiCorp | Nomad Enterprise | 1.10.0< 2.0.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7474
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
Source: NVD (National Vulnerability Database)
Vulnerability Description
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
HashiCorp Nomad和HashiCorp Nomad Enterprise 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Nomad和HashiCorp Nomad Enterprise都是美国HashiCorp公司的产品。HashiCorp Nomad是一个简单灵活的调度器和编排器。用于在本地和云中大规模管理容器和非容器化应用程序。HashiCorp Nomad Enterprise是一个 Nomad 软件的专业版。 HashiCorp Nomad和HashiCorp Nomad Enterprise 2.0.1之前版本存在路径遍历漏洞，该漏洞源于路径遍历攻击，可能导致在客户端主机上执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Nomad | 1.10.0 ~ 2.0.1 | - | |
| HashiCorp | Nomad Enterprise | 1.10.0 ~ 2.0.1 | - |
II. Public POCs for CVE-2026-7474
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7474
请登录查看更多情报信息。
Same Patch Batch · HashiCorp · 2026-05-12 · 4 CVEs total
| CVE-2026-6959 | 6.0 MEDIUM | Nomad vulnerable to arbitrary file read/write on client host through symlink attack |
| CVE-2026-8052 | 6.0 MEDIUM | Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through s |
| CVE-2026-5061 | 4.7 MEDIUM | Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack |
IV. Related Vulnerabilities
Same product: Nomad
- CVE-2026-6959
Nomad vulnerable to arbitrary file read/write on client host - CVE-2025-4922
Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To - CVE-2025-1296
Nomad Exposes Sensitive Workload Identity and Client Secret - CVE-2025-0937
Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass - CVE-2024-12678
Nomad Allocations Vulnerable To Privilege Escalation Within
Same vendor: HashiCorp
- CVE-2026-8052
Nomad's exec2 task driver vulnerable to arbitrary file read/ - CVE-2026-6959
Nomad vulnerable to arbitrary file read/write on client host - CVE-2026-5061
Consul-template vulnerable to sandbox path bypass in file he - CVE-2026-7776
Boundary Workers Vulnerable to Denial of Service During TLS - CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro
Same weakness: CWE-22
- CVE-2026-8736
Oinone Pamirs RestController LocalFileClient.java request.ge - CVE-2021-47977
WordPress Anti-Malware Security Bruteforce Firewall 4.20.59 - CVE-2021-47942
Home Assistant Community Store 1.10.0 Path Traversal Account - CVE-2021-47979
WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Del - CVE-2026-44565
Open WebUI: Open WebUI Arbitrary File Write, Delete via Path
V. Comments for CVE-2026-7474
No comments yet