Log in Start free

Vulnerability · Published Jul 8, 2026 · Assigned by HashiCorp

CVE-2026-14373Nomad Docker driver Linux host namespace bypass

High 7.7

In plain English

A high-severity missing authorization in Nomad from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 72.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Affected products (as reported)

VendorProductVersions
HashiCorp Nomad 0.4.1 – before 2.0.4
HashiCorp Nomad Enterprise 0.4.1 – before 2.0.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References