Quick answers
- Is CVE-2026-14891 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14891 being exploited in the wild.
- How severe is CVE-2026-14891?
- High severity, with a CVSS score of 8.7, published 8 July 2026.
- Which products and versions are affected?
- HashiCorp Nomad 0.4.1 to 2.0.3; HashiCorp Nomad Enterprise 0.4.1 to 2.0.3; 1.11.0 to 1.11.7; 1.10.0 to 1.10.13.
- Is there a fix for CVE-2026-14891?
- A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14891 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14891?
- Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A sandbox escape vulnerability exists in the HashiCorp Nomad Docker task driver due to improper link resolution (CWE-59). The driver's containment check fails to fully account for symbolic links when validating bind mounts, allowing a mount that resolves outside the intended allocation directory. An authenticated attacker with job submission privileges (or any API client if ACLs are disabled) can exploit this to bind-mount arbitrary host paths into a container. This allows for reading and writing files on the host filesystem even when volume bind mounts are explicitly disabled. The issue is fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Affected products
- HashiCorp Nomad 0.4.1 to 2.0.3
- HashiCorp Nomad Enterprise 0.4.1 to 2.0.3; 1.11.0 to 1.11.7; 1.10.0 to 1.10.13
Timeline
- 2026-07-08: disclosed
- 2026-07-08: patched
- 2026-07-08: advisory