Security Advisory

CVE-2026-14891

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-08 20:09:05

Last updated 2026-07-09 03:55:54

Assigner HashiCorp

CVSS score 8.7

State PUBLISHED

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

← Browse all CVEs View on cve.org ↗