HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion

{
  "id": "292dec497ee0044f3e8943c6749123a0eb25d36d17617b1f4b1ba64047edd1dc",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-22-nomad-vulnerable-to-cross-namespace-host-volume-claim-deletion/77562",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion",
    "summary": "Nomad and Nomad Enterprise could allow an operator with host volume delete permission in one namespace to delete a sticky volume claim in another namespace. An authenticated operator with the relevant permission is required; the impact is on scheduling correctness.",
    "evidence": "Nomad did not consistently verify that a sticky volume claim targeted for deletion belonged to the namespace the requester was authorized for.",
    "products": [
      {
        "name": {
          "value": "Nomad Community Edition",
          "evidence": "This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4"
        },
        "prerequisites": [
          {
            "value": "an authenticated operator holding the relevant permission in at least one namespace",
            "evidence": "This issue requires an authenticated operator holding the relevant permission in at least one namespace."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.4",
            "evidence": "fixed in Nomad 2.0.4"
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.0.3",
            "evidence": "Nomad and Nomad Enterprise up to 2.0.3"
          }
        ]
      },
      {
        "name": {
          "value": "Nomad Enterprise",
          "evidence": "Nomad and Nomad Enterprise up to 2.0.3"
        },
        "prerequisites": [
          {
            "value": "an authenticated operator holding the relevant permission in at least one namespace",
            "evidence": "This issue requires an authenticated operator holding the relevant permission in at least one namespace."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.4",
            "evidence": "Nomad Enterprise 2.0.4"
          },
          {
            "value": "1.11.8",
            "evidence": "Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14."
          },
          {
            "value": "1.10.14",
            "evidence": "Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14."
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.0.3",
            "evidence": "Nomad and Nomad Enterprise up to 2.0.3"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-14896",
        "product": "Nomad Community Edition",
        "evidence": "This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4"
      },
      {
        "cve": "CVE-2026-14896",
        "product": "Nomad Enterprise",
        "evidence": "This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-14896",
        "evidence": "This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24019,
  "published_at": "2026-07-08T20:18:59+00:00"
}