What is the CVSS score of CVE-2026-14891?

CVE-2026-14891 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of HashiCorp Nomad are affected by CVE-2026-14891?

A high-severity container security flaw in HashiCorp Nomad (Community and Enterprise editions) allows users with job submission permissions to directly access and modify files on the underlying host…. A patch is available.

How to fix or mitigate CVE-2026-14891?

Within 24 hours: inventory all Nomad deployments and current versions in use. Within 7 days: disable Docker task driver or restrict job submission access to trusted teams only. Within 30 days: upgrade to Nomad 2.0.4 (CE), 2.0.4 (Enterprise), 1.11.8, or 1.10.14 depending on your deployed version.

HashiCorp Nomad CVE-2026-14891

EUVD-2026-42345 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-07-08 security@hashicorp.com

GHSA-5c56-jfhx-4gcm

Hashicorp Information Disclosure Docker

8.7

CVSS 3.1 · Vendor: hashicorp

Severity by source

Vendor (hashicorp) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Job submission over the network API needs a privileged submit-job token (PR:H, AV:N, AC:L); container-to-host escape is a scope change (S:C) yielding host read/write (C:H/I:H) with no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (hashicorp).

CVSS VectorVendor: hashicorp

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:40 vuln.today

DescriptionCVE.org

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Articles & Coverage 2

News 4 New HashiCorp Vulnerabilities - 1 Critical, 3 High, 1 With POC Jul 09, 2026 News 4 New Docker Vulnerabilities - 1 Critical, 3 High, 1 With POC Jul 09, 2026

AnalysisAI

Container-to-host sandbox escape in HashiCorp Nomad and Nomad Enterprise lets an authenticated job submitter using the Docker task driver bind-mount an arbitrary host path into their container even when volume bind mounts are administratively disabled, enabling read and write access to files on the underlying host. The scope-changing flaw (CVSS 3.1 8.7) affects the Community and Enterprise editions and is fixed in Nomad 2.0.4 (CE), and Enterprise 2.0.4, 1.11.8, and 1.10.14. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain Nomad job-submit token

Delivery

Craft Docker task with symlink-based mount

Exploit

Submit job bypassing disabled bind mounts

Execution

Container resolves mount to host path

Impact

Read/write sensitive host files

Access

Obtain Nomad job-submit token

Delivery

Craft Docker task with symlink-based mount

Exploit

Submit job bypassing disabled bind mounts

Execution

Container resolves mount to host path

Impact

Read/write sensitive host files

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) a target running the Nomad Docker task driver, and (2) the attacker possessing job-submission privileges on the cluster (an ACL token with submit-job capability), consistent with the CVSS PR:H rating. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, score 8.7) signals a network-reachable, low-complexity attack requiring high privileges, with a scope change and high confidentiality and integrity impact but no availability impact - consistent with an authenticated job submitter breaking out of the container boundary to the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A developer or tenant holding a Nomad job-submit token crafts a Docker task whose mount configuration abuses symlink/path resolution to point at a sensitive host path (e.g., credentials, TLS keys, or system binaries) despite bind mounts being disabled. When the job is scheduled onto a client node, the container gains read/write access to that host path, letting the attacker exfiltrate secrets or tamper with host files. …
Remediation	Vendor-released patch: upgrade to Nomad Community Edition 2.0.4, or Nomad Enterprise 2.0.4, 1.11.8, or 1.10.14 depending on your release line, per HashiCorp advisory HCSEC-2026-21 (https://discuss.hashicorp.com/t/hcsec-2026-21-nomad-vulnerable-to-sandbox-escape-in-docker-task-driver/77561). … Detailed patch versions, workarounds, and compensating controls in full report.