HashiCorp Nomad EUVD-2026-29826

Exploitation requires the dynamic host volume feature to be in use on the target Nomad client node, and the attacker must possess a Nomad ACL token/credentials authorized to create or submit dynamic host volumes (reflected by CVSS PR:L). The concrete prerequisite is the ability to control the path field of a dynamic host volume specification, into which path traversal sequences are injected. Limiting factors that reduce real-world risk: exploitation is not possible against clusters where dynamic host volumes are unused or where volume-creation ACLs are restricted to trusted operators; it is authenticated (not anonymous) per PR:L; and CISA SSVC rates it non-automatable with no observed exploitation. Affected deployments are restricted to Nomad/Nomad Enterprise 1.10.0 through versions before 2.0.1.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation that requires low-level privileges (PR:L) but no user interaction, with total confidentiality, integrity, and availability impact on the client host. These raw signals are tempered by real-world exploitation data: EPSS is only 0.03% (9th percentile), and CISA's SSVC assessment records Exploitation as 'none', Automatable as 'no', while confirming Technical Impact as 'total'. The PR:L requirement is significant - an attacker must already hold Nomad API credentials with the ability to create or submit dynamic host volumes, so this is primarily a privilege-escalation / sandbox-escape risk for tenants and semi-trusted operators rather than an anonymous internet-facing RCE. Overall this is a genuine priority for multi-tenant Nomad clusters where volume-creation rights are delegated, but the low EPSS, 'none' exploitation status, and required privileges mean it is not a mass-exploitation, drop-everything scenario for hardened single-tenant deployments.

An attacker holding a Nomad ACL token with dynamic host volume creation rights on a multi-tenant cluster submits a volume specification containing traversal sequences (e.g., '../../') in the path field, causing the client agent to provision or mount a directory outside the intended volume root. Leveraging the elevated privileges of the Nomad client agent, they write a malicious binary or script to a sensitive location and achieve code execution on the client host. No public proof-of-concept exploit has been identified at time of analysis, and the low AC and no-UI requirement make the technical exploitation straightforward once the required privilege is held.