CVE-2026-7474: falha de alta gravidade em HashiCorp Nomad
Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 8.2%
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEs relacionadas — HashiCorp Nomad
No mesmo produto, das mais perigosas para as menos.
CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2023-1782CRITICALNomad Unauthenticated Client Agent HTTP Request Privilege EscalationEPSS 0.8%CVE-2022-3866MEDIUMNomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/EPSS 0.6%CVE-2024-1329HIGHNomad Vulnerable to Arbitrary Write Through Symlink AttackEPSS 0.6%CVE-2023-3299LOWNomad Caller ACL Token's Secret ID is Exposed to SentinelEPSS 0.6%CVE-2023-3300MEDIUMNomad Search API Leaks Information About CSI PluginsEPSS 0.6%