A flaw in the Docker task driver of HashiCorp Nomad and Nomad Enterprise allows a job submitter to bind‑mount an arbitrary host path inside a container even when volume bind mounts are disabled. This capability permits direct read or write access to host files, exposing confidential data and potentially altering system state. The vulnerability stems from a path‑traversal weakness documented as CWE‑59.

All releases of Nomad Community Edition before version 2.0.4 and all releases of Nomad Enterprise before version 1.11.8, before version 1.10.14, or before version 2.0.4 are affected. The patch versions are Nomad CE 2.0.4+, Nomad Enterprise 1.11.8+, 1.10.14+, and 2.0.4+

The CVSS score of 8.7 classifies the issue as high severity, indicating significant impact if exploited. The EPSS score of < 1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, implying no confirmed public exploits. The attack vector requires the attacker to submit a Nomad job; upon execution, the attacker can mount host directories within the container, enabling direct file access on the host.