CVE-2026-14373
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The vulnerability in Nomad and Nomad Enterprise is due to the lack of enforcement of the allow_privileged restriction for the Docker task driver's host namespace mode options. This allows an authenticated job submitter to run a container in a host namespace and access information belonging to the host or other workloads on the same client.
Risk Assessment
The risk involves potential leakage of sensitive data between workloads and privilege escalation within the Nomad environment, which could lead to cluster isolation and security breaches.
Recommendation
It is recommended to immediately upgrade Nomad to version 2.0.4 (Community Edition) or Nomad Enterprise to version 2.0.4, 1.11.8, or 1.10.14, depending on the version in use.
Other vulnerabilities in HashiCorp Nomad
See all- CVE-2026-14896Medium
A vulnerability in Nomad and Nomad Enterprise allows cross-namespace authorization bypass in the dynamic host volumes feature. An operator with host volume delete permission in one namespace can delete a sticky volume claim belonging to a job in another namespace.
- CVE-2026-14891High
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that allows a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host.
Original NVD description (English source)
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.