HashiCorp Nomad vulnerabilities

A vulnerability in Nomad and Nomad Enterprise allows cross-namespace authorization bypass in the dynamic host volumes feature. An operator with host volume delete permission in one namespace can delete a sticky volume claim belonging to a job in another namespace.

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that allows a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host.

The vulnerability in Nomad and Nomad Enterprise is due to the lack of enforcement of the allow_privileged restriction for the Docker task driver's host namespace mode options. This allows an authenticated job submitter to run a container in a host namespace and access information belonging to the host or other workloads on the same client.