CVE-2026-7474: HashiCorp Nomad Path Traversal Vulnerability
Summary
CVE-2026-7474: HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad. Affects github.com/hashicorp/nomad versions < 1.11.0-rc.1.0.20260511152149-cd7240c4099a. Fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is a flexible, enterprise-grade cluster manager and scheduler designed for deploying and managing applications in a distributed environment. It enables users to run applications on a cluster of machines, providing features such as job scheduling, resource management, and service discovery. However, it has been identified that Nomad is vulnerable to a path traversal issue, which could potentially allow unauthorized access to sensitive files within the system.
Vulnerability Detail
The vulnerability in HashiCorp Nomad arises from a path traversal flaw that allows an attacker to manipulate file paths in a way that could lead to unauthorized access to files outside of the intended directory. This could result in the exposure of sensitive information or system files, posing a significant security risk. The issue is rooted in the way file paths are handled within the Nomad codebase, specifically in the github.com/hashicorp/nomad repository.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0-rc.1.0.20260511152149-cd7240c4099a
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v1.11.0-rc.1.0.20260511152149-cd7240c4099aTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive directories and files by implementing stricter file permissions and ensuring that only authorized users have access to the Nomad configuration files. Additionally, monitoring logs for unusual access patterns can help mitigate potential exploitation.
Conclusion
The path traversal vulnerability in HashiCorp Nomad poses a significant risk to users, allowing unauthorized access to sensitive files. It is crucial for users to update to the patched version to ensure their systems remain secure. Implementing temporary workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
The vulnerability is a path traversal issue that allows unauthorized access to files outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive files, potentially compromising the security of your application and data.
Yes, a patch is available in version 1.11.0-rc.1.0.20260511152149-cd7240c4099a and later. Users should update to this version to mitigate the risk.
If immediate updating is not possible, implement stricter file permissions and monitor access logs to mitigate potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
