CVE-2026-14896

Description

HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

PUBLISHED Reserved 2026-07-06 | Published 2026-07-08 | Updated 2026-07-08 | Assigner HashiCorp

Problem types

CWE-863: Incorrect Authorization

Product status

Credits

This issue was reported to HashiCorp by George Chen.

References

discuss.hashicorp.com/...ce-host-volume-claim-deletion/77562

cve.org (CVE-2026-14896)

nvd.nist.gov (CVE-2026-14896)

Download JSON