CVE-2026-14896: HashiCorp Nomad Auth Bypass Vulnerability

CVE-2026-14896 Overview

CVE-2026-14896 is a cross-namespace authorization bypass affecting HashiCorp Nomad and Nomad Enterprise. The flaw resides in the dynamic host volumes feature. An operator holding the host volume delete permission in one namespace can delete a sticky volume claim belonging to a job in a different namespace. This breaks Nomad's namespace isolation model and allows unauthorized modification of resources outside the operator's authorized scope. The vulnerability maps to CWE-863: Incorrect Authorization. HashiCorp addressed the issue in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

Critical Impact
An authenticated operator with delete permission on host volumes in one namespace can delete sticky volume claims tied to workloads in another namespace, disrupting job scheduling and data continuity.

Affected Products

HashiCorp Nomad Community Edition prior to 2.0.4
HashiCorp Nomad Enterprise prior to 2.0.4, 1.11.8, and 1.10.14
Nomad deployments using the dynamic host volumes feature

Discovery Timeline

2026-07-08 - CVE-2026-14896 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14896

Vulnerability Analysis

HashiCorp Nomad uses namespaces to isolate jobs, resources, and access control policies within a cluster. The dynamic host volumes feature allows operators to provision and manage persistent storage claims for jobs. Sticky volume claims bind a job allocation to a specific host volume so that subsequent placements reuse the same storage. The vulnerability breaks the namespace boundary that should scope volume claim operations. An operator authenticated with a token that grants host-volume:delete capability in one namespace can invoke the delete operation against sticky volume claims associated with jobs owned by other namespaces. The authorization check validates that the caller holds the delete permission but fails to verify that the target claim resides within the caller's authorized namespace.

Root Cause

The root cause is missing namespace scoping in the authorization logic for the host volume claim deletion API path. The handler evaluates capability tokens against the requested action but does not cross-check the target object's namespace against the caller's namespace grants. This is a classic [CWE-863] incorrect authorization pattern where the permission model is enforced at the verb level but not at the resource-ownership level.

Attack Vector

Exploitation requires network access to the Nomad API and a valid ACL token with host volume delete permission in at least one namespace. The attacker sends a delete request targeting a sticky volume claim identifier that belongs to a job in a different namespace. Because the server does not enforce namespace membership on the target claim, the deletion succeeds. The result is denial of storage continuity for the victim job, forcing rescheduling and potential loss of stateful data affinity. Full technical details are documented in the HashiCorp Security Advisory HCSEC-2026-22.

Detection Methods for CVE-2026-14896

Indicators of Compromise

Audit log entries showing host-volume delete API calls where the caller token's namespace differs from the target claim's namespace.
Unexpected sticky volume claim deletions correlated with job rescheduling events in namespaces the acting operator does not own.
Repeated cross-namespace enumeration of volume claim IDs preceding delete calls.

Detection Strategies

Enable Nomad audit logging and forward events to a centralized log platform for correlation of token identity, namespace, and target resource namespace.
Baseline normal operator behavior per namespace and alert on delete operations that target resources outside the operator's assigned namespaces.
Monitor Nomad server logs for DELETE /v1/volume/host/ requests and cross-reference token metadata against claim ownership.

Monitoring Recommendations

Track ACL token issuance and permissions to identify tokens holding host-volume:delete capabilities across multiple environments.
Alert on any job allocation failure caused by missing sticky volume claims to catch exploitation impact quickly.
Review Nomad version metrics regularly to confirm all servers and clients run patched builds.

How to Mitigate CVE-2026-14896

Immediate Actions Required

Upgrade Nomad Community Edition to 2.0.4 or later immediately.
Upgrade Nomad Enterprise to 2.0.4, 1.11.8, or 1.10.14 depending on the deployed release train.
Audit existing ACL policies and revoke host-volume:delete capabilities that are not strictly required.
Review recent audit logs for suspicious cross-namespace volume claim deletions.

Patch Information

HashiCorp released fixes in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. The patch enforces namespace validation on the target claim during delete operations. Refer to HashiCorp Security Advisory HCSEC-2026-22 for full remediation guidance.

Workarounds

Restrict the host-volume:delete capability to a minimal set of trusted operators until patching is complete.
Segment operator responsibilities so that no single token holds delete permissions on host volumes shared with other namespaces.
Increase audit log retention and monitoring frequency until upgrades are deployed across the cluster.

bash

# Verify Nomad version and confirm patched release is installed
nomad version

# Example ACL policy restricting host-volume delete to a single namespace
cat <<EOF > restricted-operator.hcl
namespace "team-a" {
  capabilities = ["host-volume-register", "host-volume-read"]
  host_volume "*" {
    capabilities = ["mount-readwrite"]
  }
}
EOF

nomad acl policy apply -description "Restricted operator" restricted-operator restricted-operator.hcl