Auth bypass in Hashicorp Nomad
CVE-2026-14373
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access…
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Hashicorp Nomad — versions 0.4.1
- Hashicorp Nomad Enterprise — versions 0.4.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-14373?
- CVE-2026-14373 is a high-severity vulnerability in Hashicorp Nomad, classified under Missing Authorization. CVSS score: 7.7/10. Published 2026-07-08.
- How severe is CVE-2026-14373?
- High severity. CVSS v3 base score is 7.7 out of 10.