CVE-2026-14896: HashiCorp Nomad authorization bypass in dynamic host volumes

CVE-2026-14896 · Severity: medium · CVSS 4.2 · Published 2026-07-08

HashiCorp Nomad, a tool used to manage and schedule applications across servers, contains a security flaw in how it handles storage volume permissions. An authorized user with permission to manage storage in one project (namespace) could delete storage assignments belonging to a different project. While this does not expose data, it can disrupt operations by causing applications to lose their connection to specific persistent data when they are restarted or moved.

Technologies: HashiCorp Nomad, HashiCorp Nomad Enterprise. Vendors: HashiCorp.

Quick answers

Is CVE-2026-14896 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14896 being exploited in the wild.
How severe is CVE-2026-14896?
Medium severity, with a CVSS score of 4.2, published 8 July 2026.
Which products and versions are affected?
HashiCorp Nomad 0.4.1 up to 2.0.3; HashiCorp Nomad Enterprise 0.4.1 up to 2.0.3; 1.11.0 up to 1.11.7; 1.10.0 up to 1.10.13.
Is there a fix for CVE-2026-14896?
A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14896 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-14896?
Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-namespace authorization bypass (CWE-863) exists in Nomad's dynamic host volumes feature. The vulnerability stems from a failure to consistently verify that a sticky volume claim targeted for deletion belongs to the same namespace as the authenticated requester. An attacker must be an authenticated operator with 'host volume delete' permissions in at least one namespace. By exploiting this, the attacker can delete volume claims in other namespaces, which impacts scheduling correctness; when affected allocations are rescheduled or updated, they may fail to reconnect to the correct host volume. The issue is fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Affected products

  • HashiCorp Nomad 0.4.1 up to 2.0.3
  • HashiCorp Nomad Enterprise 0.4.1 up to 2.0.3; 1.11.0 up to 1.11.7; 1.10.0 up to 1.10.13

Timeline

  • 2026-07-08: disclosed
  • 2026-07-08: patched
  • 2026-07-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.