CVE-2026-14373: falha de alta gravidade em HashiCorp Nomad
Nomad Docker driver Linux host namespace bypass
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.3%
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVEs relacionadas — HashiCorp Nomad
No mesmo produto, das mais perigosas para as menos.
CVE-2026-7474HIGHNomad vulnerable to path traversal in dynamic host volume which may lead to code executionEPSS 8.2%CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2023-1782CRITICALNomad Unauthenticated Client Agent HTTP Request Privilege EscalationEPSS 0.8%CVE-2024-1329HIGHNomad Vulnerable to Arbitrary Write Through Symlink AttackEPSS 0.6%CVE-2023-3299LOWNomad Caller ACL Token's Secret ID is Exposed to SentinelEPSS 0.6%CVE-2023-3300MEDIUMNomad Search API Leaks Information About CSI PluginsEPSS 0.6%