CVE-2026-7474: 
Nomad vulnerability analysis and mitigation

CVE-2026-7474 is a path traversal vulnerability in HashiCorp Nomad and Nomad Enterprise that enables authenticated low-privilege users to execute arbitrary code on the Nomad client host. It affects Nomad and Nomad Enterprise versions from 1.10.0 up to (but not including) 2.0.1, and was disclosed on May 12, 2026. Fixed versions are 2.0.1, 1.11.5, and 1.10.11. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, HashiCorp Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and resides in Nomad's dynamic host volume functionality. An attacker can craft a malicious path that escapes the intended restricted directory, allowing arbitrary file access or code execution on the underlying client host. Exploitation requires only low-level authenticated network access with no user interaction, making it straightforward to leverage once credentials are obtained. The relevant fix is tracked in the Nomad source repository commit cd7240c4099a (GitHub Advisory, HashiCorp Advisory).

Successful exploitation allows an authenticated attacker with low privileges to execute arbitrary code on the Nomad client host, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive files, modify system configurations, disrupt workloads, or use the compromised client as a pivot point for lateral movement within the cluster or broader infrastructure. The scope is limited to the affected client host, but in multi-tenant or shared Nomad environments, this could expose workloads and secrets belonging to other tenants (GitHub Advisory, HashiCorp Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.031–0.039%, placing it in the 12th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Nomad deployments running versions between 1.10.0 and 2.0.1 (exclusive) by querying the Nomad API or inspecting version endpoints exposed on the network.
2. Obtain low-privilege credentials: Acquire a valid Nomad authentication token with at minimum low-privilege access (e.g., via a compromised job, leaked ACL token, or weak authentication configuration).
3. Craft malicious dynamic host volume request: Submit a request to the Nomad API that specifies a dynamic host volume path containing path traversal sequences (e.g., ../../) designed to escape the intended restricted directory on the client host.
4. Trigger code execution: Leverage the traversed path to write or reference a malicious file (e.g., a script or binary) outside the allowed directory, causing the Nomad client to execute it in the context of the Nomad service account.
5. Achieve objective: Use the resulting code execution to exfiltrate secrets, establish persistence, or pivot to other systems within the cluster (GitHub Advisory, HashiCorp Advisory).

• Network: Unusual API requests to Nomad control plane endpoints involving dynamic host volume operations with path traversal sequences (../, %2e%2e%2f, or URL-encoded variants) in volume path parameters.
• Logs: Nomad client logs showing volume mount or file access attempts referencing paths outside expected directories; unexpected errors related to host volume path resolution.
• File System: Unexpected files or scripts created outside of Nomad's designated data or allocation directories on client hosts; new executables or shell scripts in system directories owned by the Nomad service account.
• Process: Unusual child processes spawned by the Nomad client agent (e.g., /bin/sh, bash, curl, wget) not associated with legitimate job workloads.

HashiCorp has released patched versions: Nomad 2.0.1, 1.11.5, and 1.10.11 — upgrading to one of these versions is the primary recommended remediation (GitHub Advisory, HashiCorp Advisory). As interim mitigations, restrict network access to Nomad control plane API endpoints using firewalls or network policies, and enforce strict ACL controls to limit which users or services can interact with dynamic host volume APIs. Audit existing Nomad ACL tokens and revoke any that are unnecessary or overly permissive.

HashiCorp published an official security advisory (HCSEC-2026-15) disclosing the vulnerability and providing patched versions on May 12, 2026 (HashiCorp Advisory). Tenable released a Nessus detection plugin (ID 314660) shortly after disclosure. The CVE was noted in automated security feeds and community trackers, but no significant researcher commentary or broad media coverage has been identified beyond standard vulnerability aggregation.