Is CVE-2026-7474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7474 being exploited in the wild.

How severe is CVE-2026-7474?

High severity, with a CVSS score of 8.8, published 12 May 2026.

Which products and versions are affected?

github.com/hashicorp/nomad (Go) < 1.11.0-rc.1.0.20260511152149-cd7240c4099a, SEMVER:introduced=0,fixed=1.11.0-rc.1.0.20260511152149-cd7240c4099a; HashiCorp Nomad 1.10.0 to 2.0.0, 1.10.0 to 2.0.0, fixed in 2.0.1, 1.11.5, and 1.10.11; HashiCorp Nomad Enterprise 1.10.0 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10, 1.10.0 to 2.0.0, fixed in 2.0.1, 1.11.5, and 1.10.11.

Is there a fix for CVE-2026-7474?

Yes. github.com/hashicorp/nomad (Go): upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7474 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-7474?

Check whether you run github.com/hashicorp/nomad (Go), HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7474: HashiCorp Nomad path traversal in Dynamic Host Volumes

Q: Is there a fix for CVE-2026-7474?

Yes. github.com/hashicorp/nomad (Go): upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-7474 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-7474?

Check whether you run github.com/hashicorp/nomad (Go), HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7474 · Severity: high · CVSS 8.8 · Published 2026-05-12

HashiCorp Nomad is a workload orchestrator used to deploy and manage applications across data centers. A security flaw in its 'Dynamic Host Volumes' feature allows an authorized user to trick the system into running unauthorized programs on the host server. This could lead to a complete takeover of the server, potentially exposing sensitive data or disrupting business operations.

Technologies: github.com/hashicorp/nomad (Go), HashiCorp Nomad, HashiCorp Nomad Enterprise. Vendors: Go, HashiCorp.

Quick answers

Is CVE-2026-7474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7474 being exploited in the wild.
How severe is CVE-2026-7474?: High severity, with a CVSS score of 8.8, published 12 May 2026.
Which products and versions are affected?: github.com/hashicorp/nomad (Go) < 1.11.0-rc.1.0.20260511152149-cd7240c4099a, SEMVER:introduced=0,fixed=1.11.0-rc.1.0.20260511152149-cd7240c4099a; HashiCorp Nomad 1.10.0 to 2.0.0, 1.10.0 to 2.0.0, fixed in 2.0.1, 1.11.5, and 1.10.11; HashiCorp Nomad Enterprise 1.10.0 to 2.0.0, 1.11.0 to 1.11.4, 1.10.0 to 1.10.10, 1.10.0 to 2.0.0, fixed in 2.0.1, 1.11.5, and 1.10.11.
Is there a fix for CVE-2026-7474?: Yes. github.com/hashicorp/nomad (Go): upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7474 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-7474?: Check whether you run github.com/hashicorp/nomad (Go), HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hashicorp/nomad (Go): upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a or later
```
go get github.com/hashicorp/nomad@v1.11.0-rc.1.0.20260511152149-cd7240c4099a
```

Technical details

A path traversal vulnerability (CWE-22) exists in HashiCorp Nomad's Dynamic Host Volumes workflow. When a user with 'host-volume-create' and node read access submits a request, they can manipulate the 'plugin_id' parameter. Because the Nomad agent joins this ID to the plugin directory path without sufficient validation, an attacker can use traversal sequences (e.g., ../) to execute arbitrary binaries located outside the intended plugin directory. These binaries are executed with the same privileges as the Nomad agent, typically root. The issue is fixed in versions 2.0.1, 1.11.5, and 1.10.11 by implementing 'os.Root' checks and enforcing server-side plugin validation even when a specific node ID is provided.

Affected products

HashiCorp Nomad 1.10.0 to 2.0.0, fixed in 2.0.1, 1.11.5, and 1.10.11
HashiCorp Nomad Enterprise 1.10.0 to 2.0.0, fixed in 2.0.1, 1.11.5, and 1.10.11

Identifiers

CVE-2026-7474
GHSA-hx53-77qj-8663
GO-2026-5445

Timeline

2026-05-12: disclosed
2026-05-12: patched
2026-05-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.