# Nomad ent-changelog-1.11.8 — v1.11.8 (Enterprise)

- Product: Nomad (https://whatsnew.fyi/product/nomad)
- Vendor: HashiCorp
- Date: 2026-07-08
- Version: ent-changelog-1.11.8
- Original notes: https://github.com/hashicorp/nomad/releases/tag/ent-changelog-1.11.8
- Permalink: https://whatsnew.fyi/product/nomad/releases/ent-changelog-1.11.8

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Enforce `allowed_modes` or `allow_privileged` requirement to set host namespace modes in docker task
- **security** — Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false
- **security** — Fixed a bug where users with `host-volume-delete` in one namespace could delete claims from another namespace
- **changed** — Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable
- **added** — Added optional `Init` function for task driver plugins
- **added** — Added optional `Shutdown` function for task driver plugins
- **fixed** — Allow using workload identity tokens on plan endpoint
- **fixed** — Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI
- **fixed** — Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted
- **fixed** — Expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs
- **fixed** — Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests
- **fixed** — Fixed a bug where setting `sticky` on a static host volume could fail the evaluation instead of being rejected during feasibility checking
- **fixed** — Keep draining batch alloc counted when node is re-enabled
- **fixed** — Improve the memory management for secrets
- **fixed** — Fixed a bug where jobs that share a ModifyIndex were omitted from the jobs page and the `/v1/jobs/statuses` endpoint
- **fixed** — Fixed an issue where streaming task logs would error

SECURITY:

* docker: Enforce `allowed_modes` or `allow_privileged` requirement to set host namespace modes in task. This is CVE-2026-14891. [[GH-28190](https://github.com/hashicorp/nomad/issues/28190)]
* docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [[GH-28177](https://github.com/hashicorp/nomad/issues/28177)]
* dynamic host volumes: Fixed a bug where users with `host-volume-delete` in one namespace could delete claims from another namespace [[GH-28205](https://github.com/hashicorp/nomad/issues/28205)]

IMPROVEMENTS:

* consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [[GH-28106](https://github.com/hashicorp/nomad/issues/28106)]
* driver: Added optional `Init` function for task driver plugins [[GH-28104](https://github.com/hashicorp/nomad/issues/28104)]
* driver: Added optional `Shutdown` function for task driver plugins [[GH-28102](https://github.com/hashicorp/nomad/issues/28102)]

BUG FIXES:

* api: allow using WI tokens on plan endpoint [[GH-28139](https://github.com/hashicorp/nomad/issues/28139)]
* cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [[GH-28138](https://github.com/hashicorp/nomad/issues/28138)]
* dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [[GH-28198](https://github.com/hashicorp/nomad/issues/28198)]
* metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [[GH-28170](https://github.com/hashicorp/nomad/issues/28170)]
* scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [[GH-28097](https://github.com/hashicorp/nomad/issues/28097)]
* scheduler: Fixed a bug where setting `sticky` on a static host volume could fail the evaluation instead of being rejected during feasibility checking [[GH-28097](https://github.com/hashicorp/nomad/issues/28097)]
* scheduler: keep draining batch alloc counted when node is re-enabled [[GH-28018](https://github.com/hashicorp/nomad/issues/28018)]
* task runner: Improve the memory management for secrets [[GH-28140](https://github.com/hashicorp/nomad/issues/28140)]
* ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the `/v1/jobs/statuses` endpoint [[GH-28132](https://github.com/hashicorp/nomad/issues/28132)]
* ui: fixes an issue where streaming task logs would error [[GH-28137](https://github.com/hashicorp/nomad/issues/28137)]