Vulnerability · Published Jul 8, 2026 · Assigned by HashiCorp
CVE-2026-14891Nomad vulnerable to sandbox escape in Docker task driver
High 8.7
In plain English
A high-severity security flaw in Nomad from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Nomad | 0.4.1 – before 2.0.4 |
| HashiCorp | Nomad Enterprise | 0.4.1 – before 2.0.4 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N