Privilege Escalation in HashiCorp Nomad via Docker Host Namespace

Executive Summary

CVE-2026-14373 is a vulnerability in HashiCorp Nomad and Nomad Enterprise where the Docker task driver did not properly enforce the allow_privileged restriction for host namespace mode options on Linux.

This flaw allows an authenticated job submitter to run a container in the host's namespace, which means the container can access information belonging to the host system or other workloads running on the same client.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying whether your Nomad environment is running a vulnerable version (up to 2.0.3) and if Docker task driver jobs are being submitted with host namespace mode options without enforcement of the allow_privileged restriction.

You can check the Nomad version by running the command:

• nomad version

To detect if any jobs are using the Docker driver with host namespace mode options, you can inspect running jobs or job specifications for Docker tasks that request host namespaces.

For example, you might use Nomad CLI commands to list jobs and inspect their task configurations:

• nomad job status
• nomad job inspect <job_id>

Look specifically for Docker tasks with host namespace mode options enabled, which may indicate potential exploitation or risk.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Nomad or Nomad Enterprise to a fixed version: 2.0.4, 1.11.8, or 1.10.14.

If upgrading is not immediately possible, Nomad Enterprise users can implement a Sentinel policy to restrict the use of host namespaces for Docker tasks, preventing authenticated job submitters from running containers in host namespaces.

Additionally, review and restrict job submission permissions to trusted users only, minimizing the risk of exploitation.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an authenticated user who can submit jobs to run containers with elevated access to the host's namespace.

This can lead to unauthorized access to sensitive information on the host or other workloads, potentially compromising confidentiality.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated job submitter to run a container in a host namespace and access sensitive information belonging to the host or other workloads on the same client. This unauthorized access to sensitive information could potentially lead to non-compliance with data protection standards and regulations such as GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

However, the provided information does not explicitly detail the impact on compliance frameworks or specific regulatory requirements.

Useful 0 Not Useful 0