# CVE-2026-14373: HashiCorp Nomad authorization bypass in Docker task driver host namespaces

Source: https://junglewise.ai/threats/cve-2026-14373-hashicorp-nomad-authorization-bypass-in-docker-task-driver-host  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-14373 · Severity: high · CVSS 7.7 · Published 2026-07-08

HashiCorp Nomad is a workload orchestrator used to deploy and manage applications across servers. A security flaw in its Docker integration allows authorized users to bypass safety restrictions and run containers with elevated access to the underlying host system. This could allow an attacker to steal sensitive information, such as credentials or data belonging to other applications running on the same server.

Technologies: [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad), [HashiCorp Nomad Enterprise](https://junglewise.ai/threats/technologies/nomad-enterprise). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-14373 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14373 being exploited in the wild.

**How severe is CVE-2026-14373?** High severity, with a CVSS score of 7.7, published 8 July 2026.

**Which products and versions are affected?** HashiCorp Nomad 0.4.1 to 2.0.3; HashiCorp Nomad Enterprise 0.4.1 to 2.0.3, 1.11.0 to 1.11.7, 1.10.0 to 1.10.13.

**Is there a fix for CVE-2026-14373?** A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14373 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-14373?** Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) in the Nomad Docker task driver allows authenticated job submitters to bypass the 'allow_privileged' configuration. By specifying host namespace modes (PID, IPC, user, or UTS) in a job specification, an attacker can run a container within the host's namespace even when such privileges are explicitly disabled by the administrator. This enables the container to enumerate host processes and access sensitive environment variables or credentials belonging to the Nomad agent or other workloads. The vulnerability specifically affects Linux-based clients; Windows containers are not impacted. Patches are available in versions 2.0.4, 1.11.8, and 1.10.14.

## Affected products

- HashiCorp Nomad 0.4.1 to 2.0.3
- HashiCorp Nomad Enterprise 0.4.1 to 2.0.3, 1.11.0 to 1.11.7, 1.10.0 to 1.10.13

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-19-nomad-docker-driver-vulnerable-to-host-namespace-bypass-on-linux/77557](https://discuss.hashicorp.com/t/hcsec-2026-19-nomad-docker-driver-vulnerable-to-host-namespace-bypass-on-linux/77557)

## Related threats

- [HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross)
- [HashiCorp Nomad authorization bypass in dynamic host volumes](https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes)
- [HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver)