SECURITY:
- docker: Enforce
allowed_modesorallow_privilegedrequirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] - docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
- dynamic host volumes: Fixed a bug where users with
host-volume-deletein one namespace could delete claims from another namespace [GH-28205]
IMPROVEMENTS:
- consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
- driver: Added optional
Initfunction for task driver plugins [GH-28104] - driver: Added optional
Shutdownfunction for task driver plugins [GH-28102]
BUG FIXES:
- api: allow using WI tokens on plan endpoint [GH-28139]
- cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
- dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
- metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
- scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
- scheduler: Fixed a bug where setting
stickyon a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097] - scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
- task runner: Improve the memory management for secrets [GH-28140]
- ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the
/v1/jobs/statusesendpoint [GH-28132] - ui: fixes an issue where streaming task logs would error [GH-28137]