HashiCorp Nomad Docker Driver Sandbox Escape via Symlink Vulnerability (CVE-2026-14891)

Vulnerability Overview Vulnerability ID: HCSEC-2026-21 Vulnerability Name: Sandbox Escape Vulnerability in Nomad's Docker Task Driver Release Date: July 8, 2026 CVE Number: CVE-2026-14891 Scope of Impact Affected Products/Versions: - Nomad and Nomad Enterprise up to version 2.0.3 - Patched Versions: Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14 Remediation Patch Versions: - Nomad Community Edition 2.0.4 - Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14 Detailed Information Summary: - HashiCorp Nomad and Nomad Enterprise contain a sandbox escape vulnerability in the Docker task driver. This allows job submitters to bind mount host paths into containers, even when volume bind mounts are disabled, potentially leading to the ability to read and write files on the host. Background: - Nomad's Docker task driver allows volume bind mount paths to be placed within containers. When volume bind mounts are disabled (the default setting), the driver restricts these bind mounts, allowing tasks to mount only host paths contained within their own allocated directories, rather than arbitrary host paths. Details: - The driver's container checks did not fully account for symbolic links when validating bind mounts, potentially allowing a job to bind mount a host path into its container and read/write files on the host filesystem, even if volume bind mounts are disabled. Exploitation requires the ability to submit jobs using the Docker driver, which necessitates an authenticated job submitter when ACLs are enabled, or any API client when ACLs are disabled. Remediation: - Customers should assess the risk associated with this issue and consider upgrading to Nomad Community Edition 2.0.4 or Nomad Enterprise 2.0.4, 1.11.8, or 1.10.14. Acknowledgments This issue was reported to HashiCorp by Volkan Kutsal (GitHub username @KutsalVolkan). We appreciate any efforts to coordinate the disclosure of security vulnerabilities. For information regarding HashiCorp security and vulnerability reporting, please visit https://hashicorp.com/security. Related Topics HCSEC-2026-19: Host Namespace Bypass Vulnerability in Nomad Docker Driver HCSEC-2020-23: Nomad File Sandbox Escape via Container Volume Mounts Nomad 0.12.8, 0.11.7, and 0.10.8 Release HCSEC-2020-15: Path Traversal in Dynamic Host Volumes Leading to Code Execution in Nomad HCSEC-2020-21: Nomad File Sandbox Escape via Templates and Artifact Segments Additional Page Information Views: 36 Replies: None Activity Time: 7 hours ago Navigation, Ads, Footer Skip navigation bar, ads, and footer. POC Code or Exploit Code No POC code or exploit code is included on this page.

Goal Reached Thanks to every supporter — we hit 100%!

HashiCorp Nomad Docker Driver Sandbox Escape via Symlink Vulnerability (CVE-2026-14891)