What is the CVSS score of CVE-2026-14896?

CVE-2026-14896 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14896?

Yes, a patch is available for CVE-2026-14896. Update the affected software to the latest version immediately.

HashiCorp Nomad CVE-2026-14896

EUVD-2026-42392 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-08 security@hashicorp.com

GHSA-x2cv-wq6v-3cc9

Authentication Bypass Hashicorp

4.2

CVSS 3.1 · Vendor: hashicorp

Severity by source

Vendor (hashicorp) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Network-accessible API (AV:N), operator credentials required (PR:L), and specific multi-namespace dynamic host volume configuration prerequisite (AC:H); impact limited to integrity and availability of volume claims only.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (hashicorp).

CVSS VectorVendor: hashicorp

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 22:08 vuln.today

Patch available

Jul 08, 2026 - 22:04 EUVD

DescriptionCVE.org

HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

AnalysisAI

Cross-namespace authorization bypass in HashiCorp Nomad's dynamic host volumes feature permits an authenticated operator holding host volume delete permissions in one namespace to delete sticky volume claims belonging to jobs in a different namespace. Both Nomad Community Edition and Nomad Enterprise are affected from version 0.4.1 up to 2.0.4, with Enterprise additionally receiving backport fixes in 1.11.8 and 1.10.14. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, limiting immediate risk to multi-tenant deployments where namespace isolation is an enforced security boundary.

Technical ContextAI

HashiCorp Nomad is a workload orchestrator supporting multi-tenancy through namespaces, which are intended to provide strong isolation between teams or environments sharing a cluster. The dynamic host volumes feature allows jobs to claim persistent storage on host machines; sticky volume claims are bound to specific job allocations and are expected to persist across restarts within their namespace. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic correctly verifies that the requesting operator holds the delete ACL capability within their own namespace but fails to enforce a namespace boundary check on the target volume claim, allowing the permission to reach across namespace lines. The CVSS vector AV:N reflects that the Nomad API surface is network-accessible, while AC:H indicates that exploitable conditions require a specific multi-namespace deployment with dynamic host volumes and sticky claims in active use.

RemediationAI

Upgrade to Nomad Community Edition 2.0.4 or Nomad Enterprise 2.0.4 to receive the primary fix. Nomad Enterprise users on supported older release trains may alternatively upgrade to 1.11.8 or 1.10.14, which include backported patches per the HashiCorp advisory HCSEC-2026-22 at https://discuss.hashicorp.com/t/hcsec-2026-22-nomad-vulnerable-to-cross-namespace-host-volume-claim-deletion/77562. For environments that cannot patch immediately, restrict the host volume delete ACL capability to the smallest possible set of highly trusted operators, reducing the population of principals who could exploit the cross-namespace bypass - note this trades off operational flexibility for attack surface reduction. A more complete architectural workaround is to isolate multi-tenant workloads onto separate Nomad clusters entirely, which eliminates the cross-namespace risk surface but introduces significant operational overhead in cluster management.