Riskcovery

CVE-2026-14891

Nomad vulnerable to sandbox escape in Docker task driver

State
Published
Severity
8.7 High
Published
Jul 8, 2026
Updated
Jul 9, 2026
Reserved
Jul 6, 2026

Read the record on cve.org

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Scores

CVSSScoreVectorSource
3.18.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:NHashiCorp

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access (Link Following)

Affected Products

ProductVersions
NomadHashiCorp
  • 0.4.1 to before 2.0.4Affected
Nomad EnterpriseHashiCorp
  • 0.4.1 to before 2.0.4Affectedfrom 1.11.8Not affectedfrom 1.10.14Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.