Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-14373

Nomad Docker driver Linux host namespace bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Nomad

Default version status: unaffected

  • 0.4.1 to < 2.0.4affected

HashiCorp Nomad Enterprise

Default version status: unaffected

  • 0.4.1 to < 2.0.4affected

References