CVE-2026-14896: 
Nomad vulnerability analysis and mitigation

CVE-2026-14896 is a cross-namespace authorization bypass vulnerability in HashiCorp Nomad and Nomad Enterprise affecting the dynamic host volumes feature. It allows an authenticated operator with host volume delete permission in one namespace to delete sticky volume claims belonging to jobs in another namespace. The vulnerability affects Nomad versions from 0.4.1 up to (but not including) 2.0.4, and was published on July 8, 2026. It carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Advisory, HashiCorp Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) — the product performs an authorization check but does not correctly validate namespace boundaries when processing host volume delete operations. Specifically, the dynamic host volumes feature fails to enforce namespace isolation, allowing a delete operation authorized in namespace A to affect sticky volume claims associated with jobs in namespace B. Exploitation requires network access and low-level privileges (an authenticated operator account with host volume delete permission), but does not require user interaction. No public technical write-up or proof-of-concept code has been identified (GitHub Advisory, HashiCorp Advisory).

Successful exploitation allows an authenticated operator to delete sticky volume claims belonging to jobs in namespaces they do not administer, resulting in data loss or service disruption for those jobs. The vulnerability has no confidentiality impact but carries low integrity and low availability impacts, as workloads relying on the affected volumes may fail or lose persistent data. The scope is limited to the Nomad cluster and does not enable lateral movement beyond the platform, but in multi-tenant environments the cross-namespace nature of the bypass undermines namespace isolation guarantees (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is approximately 0.16% (6th percentile), indicating a low probability of exploitation in the near term. The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, HashiCorp Advisory).

HashiCorp has released patches addressing this vulnerability. Users should upgrade to one of the following fixed versions: Nomad Community Edition 2.0.4, Nomad Enterprise 2.0.4, Nomad Enterprise 1.11.8, or Nomad Enterprise 1.10.14. As an interim measure, administrators should review and restrict host volume delete permissions following the principle of least privilege, and enforce strict namespace isolation policies to limit the blast radius of any operator account compromise (HashiCorp Advisory, GitHub Advisory).

The vulnerability was disclosed by HashiCorp via their security advisory forum (HCSEC-2026-22) on July 8, 2026, and was simultaneously published to the GitHub Advisory Database. Coverage has been limited to automated vulnerability tracking platforms such as VulnDB, CVEFeed, and Tenable Nessus (plugin 326541), with no notable independent researcher commentary or significant social media discussion identified (HashiCorp Advisory, Tenable).