# CVE-2026-14896: HashiCorp Nomad authorization bypass in dynamic host volumes

Source: https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-14896 · Severity: medium · CVSS 4.2 · Published 2026-07-08

HashiCorp Nomad, a tool used to manage and schedule applications across servers, contains a security flaw in how it handles storage volume permissions. An authorized user with permission to manage storage in one project (namespace) could delete storage assignments belonging to a different project. While this does not expose data, it can disrupt operations by causing applications to lose their connection to specific persistent data when they are restarted or moved.

Technologies: [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad), [HashiCorp Nomad Enterprise](https://junglewise.ai/threats/technologies/nomad-enterprise). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-14896 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14896 being exploited in the wild.

**How severe is CVE-2026-14896?** Medium severity, with a CVSS score of 4.2, published 8 July 2026.

**Which products and versions are affected?** HashiCorp Nomad 0.4.1 up to 2.0.3; HashiCorp Nomad Enterprise 0.4.1 up to 2.0.3; 1.11.0 up to 1.11.7; 1.10.0 up to 1.10.13.

**Is there a fix for CVE-2026-14896?** A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14896 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-14896?** Check whether you run HashiCorp Nomad or HashiCorp Nomad Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-namespace authorization bypass (CWE-863) exists in Nomad's dynamic host volumes feature. The vulnerability stems from a failure to consistently verify that a sticky volume claim targeted for deletion belongs to the same namespace as the authenticated requester. An attacker must be an authenticated operator with 'host volume delete' permissions in at least one namespace. By exploiting this, the attacker can delete volume claims in other namespaces, which impacts scheduling correctness; when affected allocations are rescheduled or updated, they may fail to reconnect to the correct host volume. The issue is fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

## Affected products

- HashiCorp Nomad 0.4.1 up to 2.0.3
- HashiCorp Nomad Enterprise 0.4.1 up to 2.0.3; 1.11.0 up to 1.11.7; 1.10.0 up to 1.10.13

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: patched
- 2026-07-08: advisory

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-22-nomad-vulnerable-to-cross-namespace-host-volume-claim-deletion/77562](https://discuss.hashicorp.com/t/hcsec-2026-22-nomad-vulnerable-to-cross-namespace-host-volume-claim-deletion/77562)

## Related threats

- [HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross)
- [HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver)
- [HashiCorp Nomad authorization bypass in Docker task driver host namespaces](https://junglewise.ai/threats/cve-2026-14373-hashicorp-nomad-authorization-bypass-in-docker-task-driver-host)