CVE-2026-7474 is a path traversal vulnerability in HashiCorp Nomad and Nomad Enterprise prior to version 2.0.1. It allows an attacker with at least low privileges to execute arbitrary code on the client host by exploiting improper pathname restrictions. The vulnerability is fixed in Nomad versions 2.0.1, 1.11.5, and 1.10.11. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability, with network-based exploitation and no user interaction needed.

Successful exploitation of this vulnerability can lead to remote code execution on the client host, compromising confidentiality, integrity, and availability of the affected system. The attacker requires low privileges and can execute code remotely without user interaction. This poses a significant risk to environments running vulnerable Nomad versions.

A fix is available and users should upgrade to Nomad version 2.0.1, 1.11.5, or 1.10.11 to remediate this vulnerability. Since the vendor advisory confirms these fixed versions, applying the official update is the recommended mitigation. Patch status is confirmed by the vendor advisory information.