Nomad

SECURITY:

• docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190]
• docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
• dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205]

IMPROVEMENTS:

• consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
• driver: Added optional Init function for task driver plugins [GH-28104]
• driver: Added optional Shutdown function for task driver plugins [GH-28102]

BUG FIXES:

• api: allow using WI tokens on plan endpoint [GH-28139]
• cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
• dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
• metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
• scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
• scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097]
• scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
• task runner: Improve the memory management for secrets [GH-28140]
• ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132]
• ui: fixes an issue where streaming task logs would error [GH-28137]

SECURITY:

• docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190]
• docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
• dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205]

IMPROVEMENTS:

• consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
• driver: Added optional Init function for task driver plugins [GH-28104]
• driver: Added optional Shutdown function for task driver plugins [GH-28102]

BUG FIXES:

• api: allow using WI tokens on plan endpoint [GH-28139]
• cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
• dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
• metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
• scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
• scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097]
• scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
• task runner: Improve the memory management for secrets [GH-28140]
• ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132]
• ui: fixes an issue where streaming task logs would error [GH-28137]

2.0.4 (July 07, 2026)

SECURITY:

• docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190]
• docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
• dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205]

IMPROVEMENTS:

• cli: Add a -kv-path flag to nomad setup vault to configure the Vault KV mount used by the generated workload policy [GH-28183]
• cli: Added -json and -t options to the operator autopilot get-config command. [GH-27991]
• client: Add tunable for Vault default lease duration on templates for paths without leases. [GH-28199]
• consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
• driver: Added optional Init function for task driver plugins [GH-28104]
• driver: Added optional Shutdown function for task driver plugins [GH-28102]
• scheduler: Stop failed allocations first when downscaling a task group [GH-27971]

DEPRECATIONS:

• agent: Unauthenticated server join via the CLI or API is deprecated. [GH-28176]

BUG FIXES:

• api: allow using WI tokens on plan endpoint [GH-28139]
• cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
• client: Fixed a bug where a client could panic after an alloc is GC'd [GH-28187]
• dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
• metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
• scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
• scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097]
• scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
• task runner: Improve the memory management for secrets [GH-28140]
• ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132]
• ui: fixes an issue where streaming task logs would error [GH-28137]

SECURITY:

• cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063]

IMPROVEMENTS:

• build: Updated Go to 1.26.4 [GH-28080]
• vault: adds token renewal retries [GH-27947]

BUG FIXES:

• audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025]
• client: Fixed a bug where tasks could accidentally get killed mid-restart on template re-render [GH-27960]
• client: fix a bug where we could accidentally overwrite task states [GH-27944]
• consul: re-write consul service identity token when reattaching to task [GH-27936]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: store verified and canonicalised plugin configuration in the agent [GH-28083]
• template: Fixed a bug where templates with change_mode=noop would stop monitoring templates that fatally fail after initial rendering [GH-28016]
• ui: Fix a bug where jobs with HCL variables submitted via Terraform could not be started or stopped in the web UI [GH-28095]
• ui: Fix service detail page not rendering [GH-28005]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
• ui: Fixed flickering on the log streaming pop out when viewing them from job overview page [GH-28074]
• ui: Fixed the client drain popover form to provide an accessible name for assistive technologies [GH-28047]
• ui: Fixed the drain popover deadline field so its label is properly associated with the input for improved accessibility [GH-28029]
• ui: Fixed the namespace list being continually fetched when on the job overview page [GH-28074]

SECURITY:

• cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063]

IMPROVEMENTS:

• build: Updated Go to 1.26.4 [GH-28080]
• vault: adds token renewal retries [GH-27947]

BUG FIXES:

• audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025]
• client: Fixed a bug where tasks could accidentally get killed mid-restart on template re-render [GH-27960]
• client: fix a bug where we could accidentally overwrite task states [GH-27944]
• consul: re-write consul service identity token when reattaching to task [GH-27936]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: store verified and canonicalised plugin configuration in the agent [GH-28083]
• template: Fixed a bug where templates with change_mode=noop would stop monitoring templates that fatally fail after initial rendering [GH-28016]
• ui: Fix a bug where jobs with HCL variables submitted via Terraform could not be started or stopped in the web UI [GH-28095]
• ui: Fix service detail page not rendering [GH-28005]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
• ui: Fixed flickering on the log streaming pop out when viewing them from job overview page [GH-28074]
• ui: Fixed the client drain popover form to provide an accessible name for assistive technologies [GH-28047]
• ui: Fixed the drain popover deadline field so its label is properly associated with the input for improved accessibility [GH-28029]
• ui: Fixed the namespace list being continually fetched when on the job overview page [GH-28074]

FEATURES:

• core: timeouts for batch jobs [GH-27803]

SECURITY:

• cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063]

IMPROVEMENTS:

• acl: Support uploading client ACL tokens [GH-27741]
• alloc: don't restore when allocDir is inaccessible [GH-27933]
• api: added agent reload endpoint [GH-27106]
• build: Updated Go to 1.26.4 [GH-28080]
• client: Adds default_ineligible configuration option [GH-27965]
• identity: allow additional claims to be added to workload identities [GH-27786]
• vault: adds token renewal retries [GH-27947]

BUG FIXES:

• audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025]
• cli: Fixed job dispatch and job periodic force failing with a paginator error against servers older than the CLI [GH-27680]
• client: Fixed a bug where tasks could accidentally get killed mid-restart on template re-render [GH-27960]
• consul: re-write consul service identity token when reattaching to task [GH-27936]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: store verified and canonicalised plugin configuration in the agent [GH-28083]
• template: Fixed a bug where templates with change_mode=noop would stop monitoring templates that fatally fail after initial rendering [GH-28016]
• ui: Fix a bug where jobs with HCL variables submitted via Terraform could not be started or stopped in the web UI [GH-28095]
• ui: Fix service detail page not rendering [GH-28005]
• ui: Fixed flickering on the log streaming pop out when viewing them from job overview page [GH-28074]
• ui: Fixed the client drain popover form to provide an accessible name for assistive technologies [GH-28047]
• ui: Fixed the drain popover deadline field so its label is properly associated with the input for improved accessibility [GH-28029]
• ui: Fixed the namespace list being continually fetched when on the job overview page [GH-28074]

1.10.12 Enterprise (May 22, 2026)

BUG FIXES:

• ui: Fixed a bug where the client detail page would fail to render [GH-27958]
• ui: Fixed a bug where the topology page would fail to render [GH-27958]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]

1.11.6 Enterprise (May 22, 2026)

BUG FIXES:

• ui: Fixed a bug where the client detail page would fail to render [GH-27958]
• ui: Fixed a bug where the topology page would fail to render [GH-27958]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]

2.0.2 (May 22, 2026)

BUG FIXES:

• acl: fix rpc permission denied error when using node_pool="all" [GH-27973]
• ui: Fixed a bug where the client detail page would fail to render [GH-27958]
• ui: Fixed a bug where the topology page would fail to render [GH-27958]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]

BREAKING CHANGES:

• logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918]

SECURITY:

• dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919]
• logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918]
• sentinel: require sentinel-override ACL capability for overriding soft-mandatory policies on volumes
• ui: Upgraded Ember to 6.10 [GH-27674]

IMPROVEMENTS:

• api: Add "latest" flag for tagging the latest version of a job [GH-27764]
• build: Update Go toolchain to 1.26.3 [GH-27924]
• cli: Added retry for nomad job run monitoring [GH-27887]
• cli: Automatically expand nomad exec -it to -i -t [GH-27906]
• cli: job plan now propagates -hcl2-strict=false into the suggested nomad job run -check-index invocation when the user passed it on the plan command line [GH-23656]
• cli: add monitoring and verbose option to job dispatch [GH-27541]
• drivers: include volume RequestName within mount config information if available [GH-27710]
• scheduler: Add a configuration field for the number of nodes that the scheduler considers when spread or affinity is in use. This can improve scheduler performance for some cluster shapes. [GH-27650]
• server: RPC dial timeout is configurable [GH-27862]
• services: warn on job submit when job has services but no shutdown_delay [GH-27782]

BUG FIXES:

• api: Fix a bug where the Create Job, Update Job, and Scale Job APIs could fail to respect EnforceIndex under concurrent requests [GH-27832]
• core: avoid setting job to dead while waiting for allocations to reschedule [GH-27852]
• csi: improve check of StagePublishBaseDir being subdirectory of MountDir [GH-27717]
• deployments: reset ProgressDeadline after pausing and do not fail while paused [GH-27804]
• drivers: kill plugin instance on dispense failure [GH-27711]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: Fixed a bug where plugin clients would continuously leak file descriptors when the agent was restarted [GH-27885]
• scheduler: Fixed a bug where preemption of allocations by tasks that require devices could incorrectly fail placement [GH-27880]