CVE-2026-14891

8.7 Élevée

Publiée le 08/07/2026 à 22:16 · Modifiée le 09/07/2026 à 18:29 · Analyse NVD reportée · Source : security@hashicorp.com

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Traduire en français

Produits concernés

HashiCorp Nomad
HashiCorp Nomad Enterprise

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.7 Élevée	security@hashicorp.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-59

Références

https://discuss.hashicorp.com/t/hcsec-2026-21-nomad-vulnerable-to-sandbox-escape-in-docker-task-driver/77561

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories