HashiCorp Nomad CVE-2026-14891

Exploitation requires (1) a target running the Nomad Docker task driver, and (2) the attacker possessing job-submission privileges on the cluster (an ACL token with submit-job capability), consistent with the CVSS PR:H rating. The condition that makes this notable is that it works even when the operator has explicitly disabled volume/bind mounts - the security control meant to prevent host mounting is bypassed. Limiting factors: it is not pre-authentication (a valid job-submit privilege is needed), it is specific to the Docker task driver (clusters using only exec, raw_exec, or other drivers are not in scope for this vector), and it does not affect availability. No end-user interaction is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, score 8.7) signals a network-reachable, low-complexity attack requiring high privileges, with a scope change and high confidentiality and integrity impact but no availability impact - consistent with an authenticated job submitter breaking out of the container boundary to the host. The scope change and dual C:H/I:H are what push the score into the high band despite the PR:H requirement. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low today; this looks like a genuine trust-boundary/isolation defeat rather than a mass-exploitable pre-auth bug. The most important caveat is the PR:H rating: exploitation is gated behind the ability to submit jobs, so in multi-tenant or delegated-developer clusters the effective privilege bar may be lower than 'high' implies - organizations that hand out job-submit tokens broadly should treat this as more accessible than the vector suggests. The 'Information Disclosure' tag understates impact, since the description explicitly includes writing files on the host.

A developer or tenant holding a Nomad job-submit token crafts a Docker task whose mount configuration abuses symlink/path resolution to point at a sensitive host path (e.g., credentials, TLS keys, or system binaries) despite bind mounts being disabled. When the job is scheduled onto a client node, the container gains read/write access to that host path, letting the attacker exfiltrate secrets or tamper with host files. No public POC was provided at time of analysis.