# HashiCorp Nomad Enterprise vulnerabilities Source: https://junglewise.ai/threats/technologies/nomad-enterprise Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/nomad-enterprise.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 8 vulnerabilities in HashiCorp Nomad Enterprise: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119168, was published on 29 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 3 - All time: 8 (0 critical, 0 exploited in the wild) ## About HashiCorp Nomad Enterprise An enterprise-grade workload orchestrator designed to deploy and manage containers and non-containerized applications. ## Latest HashiCorp Nomad Enterprise vulnerabilities - [CVE-2026-119168: HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-107347: HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.4, published 29 Oct 2026) - [CVE-2026-102260: HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-14896: HashiCorp Nomad authorization bypass in dynamic host volumes](https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes) (medium, CVSS 4.2, published 8 Jul 2026) - [CVE-2026-14891: HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver) (high, CVSS 8.7, published 8 Jul 2026) - [CVE-2026-14373: HashiCorp Nomad authorization bypass in Docker task driver host namespaces](https://junglewise.ai/threats/cve-2026-14373-hashicorp-nomad-authorization-bypass-in-docker-task-driver-host) (high, CVSS 7.7, published 8 Jul 2026) - [CVE-2026-7474: HashiCorp Nomad path traversal in Dynamic Host Volumes](https://junglewise.ai/threats/cve-2026-7474-hashicorp-nomad-path-traversal-in-dynamic-host-volumes) (high, CVSS 8.8, published 12 May 2026) - [CVE-2026-6959: HashiCorp Nomad arbitrary file read and write via symlink attack](https://junglewise.ai/threats/cve-2026-6959-hashicorp-nomad-arbitrary-file-read-and-write-via-symlink-attack) (medium, CVSS 6, published 12 May 2026) ## Most severe HashiCorp Nomad Enterprise vulnerabilities - [CVE-2026-7474: HashiCorp Nomad path traversal in Dynamic Host Volumes](https://junglewise.ai/threats/cve-2026-7474-hashicorp-nomad-path-traversal-in-dynamic-host-volumes) (high, CVSS 8.8, published 12 May 2026) - [CVE-2026-119168: HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-14891: HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver) (high, CVSS 8.7, published 8 Jul 2026) - [CVE-2026-107347: HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.4, published 29 Oct 2026) - [CVE-2026-14373: HashiCorp Nomad authorization bypass in Docker task driver host namespaces](https://junglewise.ai/threats/cve-2026-14373-hashicorp-nomad-authorization-bypass-in-docker-task-driver-host) (high, CVSS 7.7, published 8 Jul 2026) - [CVE-2026-6959: HashiCorp Nomad arbitrary file read and write via symlink attack](https://junglewise.ai/threats/cve-2026-6959-hashicorp-nomad-arbitrary-file-read-and-write-via-symlink-attack) (medium, CVSS 6, published 12 May 2026) - [CVE-2026-102260: HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-14896: HashiCorp Nomad authorization bypass in dynamic host volumes](https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes) (medium, CVSS 4.2, published 8 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other HashiCorp technologies - [HashiCorp Consul](https://junglewise.ai/threats/technologies/consul): 11 vulnerabilities - [HashiCorp Vault](https://junglewise.ai/threats/technologies/vault): 11 vulnerabilities - [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad): 9 vulnerabilities - [HashiCorp Vault Enterprise](https://junglewise.ai/threats/technologies/vault-enterprise): 9 vulnerabilities - [HashiCorp Consul Enterprise](https://junglewise.ai/threats/technologies/consul-enterprise): 8 vulnerabilities - [HashiCorp Consul-Template](https://junglewise.ai/threats/technologies/consul-template): 3 vulnerabilities - [HashiCorp Terraform MCP Server](https://junglewise.ai/threats/technologies/terraform-mcp-server): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "HashiCorp Nomad Enterprise vulnerabilities", https://junglewise.ai/threats/technologies/nomad-enterprise, 13 November 2026.