CVE-2026-14373
published 2026-07-08CVE-2026-14373: HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow…
PriorityP346high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.34%
26.3th percentile
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | nomad | >= 0.4.1 < 2.0.4 | 2.0.4 |
| hashicorp | nomad_enterprise | >= 0.4.1 < 2.0.4 | 2.0.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HashiCorp Nomad/Nomad Enterprise prior 2.0.4/1.11.8/1.10.14 Docker Task Driver improper authentication (Nessus ID 326547)
vuldb·2026-07-14·CVSS 7.7
CVE-2026-14373 [HIGH] HashiCorp Nomad/Nomad Enterprise prior 2.0.4/1.11.8/1.10.14 Docker Task Driver improper authentication (Nessus ID 326547)
A vulnerability identified as problematic has been detected in HashiCorp Nomad and Nomad Enterprise. Affected by this vulnerability is an unknown functionality of the component Docker Task Driver. Performing a manipulation results in improper authentication.
This vulnerability is cataloged as CVE-2026-14373. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options.
ghsa_unreviewed·2026-07-08·CVSS 7.7
CVE-2026-14373 [HIGH] CWE-862 HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options.
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-08
Published