CVE-2026-14891
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that allows a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host.
Risk Assessment
The risk involves unauthorized access to the host filesystem, which could allow an attacker to read sensitive data or modify critical infrastructure files.
Recommendation
It is recommended to immediately upgrade Nomad to version 2.0.4 (Community Edition) or Nomad Enterprise to version 2.0.4, 1.11.8, or 1.10.14.
Other vulnerabilities in HashiCorp Nomad
See all- CVE-2026-14896Medium
A vulnerability in Nomad and Nomad Enterprise allows cross-namespace authorization bypass in the dynamic host volumes feature. An operator with host volume delete permission in one namespace can delete a sticky volume claim belonging to a job in another namespace.
- CVE-2026-14373High
The vulnerability in Nomad and Nomad Enterprise is due to the lack of enforcement of the allow_privileged restriction for the Docker task driver's host namespace mode options. This allows an authenticated job submitter to run a container in a host namespace and access information belonging to the host or other workloads on the same client.
Original NVD description (English source)
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.