Executive brief
HashiCorp Nomad is a workload orchestrator used to deploy and manage applications across servers. A security flaw in its Docker integration allows authorized users to bypass safety restrictions and run containers with elevated access to the underlying host system. This could allow an attacker to steal sensitive information, such as credentials or data belonging to other applications running on the same server.
Technical details
A missing authorization check (CWE-862) in the Nomad Docker task driver allows authenticated job submitters to bypass the 'allow_privileged' configuration. By specifying host namespace modes (PID, IPC, user, or UTS) in a job specification, an attacker can run a container within the host's namespace even when such privileges are explicitly disabled by the administrator. This enables the container to enumerate host processes and access sensitive environment variables or credentials belonging to the Nomad agent or other workloads. The vulnerability specifically affects Linux-based clients; Windows containers are not impacted. Patches are available in versions 2.0.4, 1.11.8, and 1.10.14.
Affected products
- HashiCorp Nomad 0.4.1 to 2.0.3
- HashiCorp Nomad Enterprise 0.4.1 to 2.0.3, 1.11.0 to 1.11.7, 1.10.0 to 1.10.13
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched