PT-2026-40385 · Hashicorp · Nomad Enterprise+1

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-7474

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad versions prior to 2.0.1 HashiCorp Nomad Enterprise versions prior to 2.0.1

Description A path traversal attack allows for code execution on the client host. Path traversal is a technique that enables attackers to access files and directories outside the intended folder by using special characters like "../".

Recommendations Update to version 2.0.1, 1.11.5, or 1.10.11.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-06946

CVE-2026-7474

GHSA-HX53-77QJ-8663

Affected Products

Nomad

Nomad Enterprise

References · 12

• https://cve.org/CVERecord?id=CVE-2026-7474 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-7474 · Security Note
• https://osv.dev/vulnerability/GHSA-hx53-77qj-8663 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06946 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7474 · Vendor Advisory
• https://github.com/hashicorp/nomad/releases/tag/v2.0.1 · Note
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/commit/cd7240c4099ad33eda279924fb3a9459b162d120 · Note
• https://twitter.com/infoflowcloud/status/2054324895027273885 · Twitter Post
• https://twitter.com/CVEnew/status/2054324107098075518 · Twitter Post
• https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417 · Note