CVE-2026-14896
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability in Nomad and Nomad Enterprise allows cross-namespace authorization bypass in the dynamic host volumes feature. An operator with host volume delete permission in one namespace can delete a sticky volume claim belonging to a job in another namespace.
Risk Assessment
The risk involves unauthorized deletion of data volumes by an operator, potentially causing data loss or disruption of critical jobs in other namespaces.
Recommendation
Immediately upgrade Nomad Community Edition to version 2.0.4 or later, and Nomad Enterprise to version 2.0.4, 1.11.8, or 1.10.14.
Other vulnerabilities in HashiCorp Nomad
See all- CVE-2026-14891High
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that allows a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host.
- CVE-2026-14373High
The vulnerability in Nomad and Nomad Enterprise is due to the lack of enforcement of the allow_privileged restriction for the Docker task driver's host namespace mode options. This allows an authenticated job submitter to run a container in a host namespace and access information belonging to the host or other workloads on the same client.
Original NVD description (English source)
HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.