Nomad Docker Driver Sandbox Escape via Unauthorized Bind-Mount Before 2.0.4
CVE-2026-14891 Published on July 8, 2026
Nomad vulnerable to sandbox escape in Docker task driver
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-14891 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-14891
Want to know whenever a new CVE is published for HashiCorp Nomad? stack.watch will email you.
Affected Versions
HashiCorp Nomad:- Version 0.4.1 and below 2.0.4 is affected.
- Version 0.4.1 and below 2.0.4 is affected.