EUVD-2026-29826
GHSA-hx53-77qj-8663
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Nomad API is network-reachable (AV:N) with low complexity, but creating a dynamic host volume requires an authorized token, so PR:L; client-host code execution yields total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
AnalysisAI
Authenticated code execution on Nomad client hosts is possible in HashiCorp Nomad and Nomad Enterprise 1.10.0 through versions prior to 2.0.1 via a path traversal flaw in the dynamic host volume feature. A submitter with volume-creation privileges can escape the intended volume directory and write to or execute code in arbitrary locations on the client node's filesystem, gaining code execution outside the intended sandbox. This flaw is not in CISA KEV and has no public exploit identified at time of analysis; EPSS probability is low at 0.03%.
Technical ContextAI
Nomad is a HashiCorp workload orchestrator that schedules containers, VMs, and standalone binaries across a fleet of client nodes, comparable in role to Kubernetes. The affected component is the dynamic host volume subsystem, which lets operators provision storage directories on client hosts that are then mounted into scheduled workloads. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): user-controlled path input for the dynamic host volume is not properly canonicalized or confined, allowing traversal sequences to reference filesystem locations outside the designated volume root. Because the Nomad client agent typically runs with elevated privileges to manage workloads, writing to arbitrary paths (e.g., binaries, plugin directories, or startup scripts) can translate directly into code execution on the client host. Affected CPEs are cpe:2.3:a:hashicorp:nomad and cpe:2.3:a:hashicorp:nomad_enterprise.
RemediationAI
Vendor-released patch: upgrade to Nomad 2.0.1, 1.11.5, or 1.10.11, which contain the fix for the dynamic host volume path traversal. Prioritize patching any Nomad client nodes that mount dynamic host volumes, and review the HashiCorp advisory HCSEC-2026-15 (https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417) for release-specific guidance. If immediate upgrade is not feasible, compensating controls include restricting the ACL policies that grant host-volume and volume-write capabilities so only fully trusted operators can create dynamic host volumes (trade-off: limits self-service storage provisioning for tenants), and disabling or not enabling the dynamic host volume feature on client nodes that do not require it (trade-off: workloads depending on dynamic host volumes will fail to schedule). Auditing existing dynamic host volume definitions for suspicious path components before and after upgrade is also advised.
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL autho
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privi
HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates use
HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. Rated critical severity (CVSS 9.8)
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using eithe
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using worklo
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenti
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to p
CVE-2025-4922 is a security vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Host namespace escape in HashiCorp Nomad and Nomad Enterprise lets an authenticated job submitter bypass the allow_privi
Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume cr
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today