CVE-2026-14896

Received Received - Intake

Cross-Namespace Authorization Bypass in Nomad

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: HashiCorp Inc.

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-14896

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	nomad	2.0.4
hashicorp	nomad_enterprise	2.0.4
hashicorp	nomad_enterprise	1.11.8
hashicorp	nomad_enterprise	1.10.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-14896 is a vulnerability in HashiCorp Nomad and Nomad Enterprise involving a cross-namespace authorization bypass in the dynamic host volumes feature.

Specifically, it allows an operator who has permission to delete host volumes in one namespace to delete a sticky volume claim that belongs to a job in a different namespace.

This means that the access control intended to isolate namespaces is bypassed, potentially allowing unauthorized deletion of resources.

Impact Analysis

This vulnerability can impact you by allowing an operator with limited permissions in one namespace to delete sticky volume claims in other namespaces.

Such unauthorized deletion could lead to data loss or disruption of jobs that rely on those volumes, affecting availability and integrity of workloads.

The CVSS base score of 4.2 indicates a moderate severity, with impacts on integrity and availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HashiCorp Nomad and Nomad Enterprise to the fixed versions: Nomad Community Edition 2.0.4 or Nomad Enterprise versions 2.0.4, 1.11.8, or 1.10.14.

Hi! I’m here to help you understand CVE-2026-14896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70