HashiCorp

Recently shipped Nomad CVE fixes, Terraform 1.16 alpha on_failure triggers, and HCP Vault 2.0.3 on AWS and Azure.

Nomad 2.0.4 and enterprise releases patched three security vulnerabilities. CVE-2026-14891 and CVE-2026-14896 addressed Docker container escape paths: host namespace mode enforcement and symlink-bypass plugin configuration. A namespace-crossing bug in dynamic host volume deletion was also fixed. Consul service, template, and connect blocks can now fall back to the client agent's Consul token when workload identity is unavailable. The nomad setup vault CLI gained a -kv-path flag for the generated workload policy's Vault KV mount. [source: https://github.com/hashicorp/nomad/releases/tag/v2.0.4] [source: https://github.com/hashicorp/nomad/releases/tag/ent-changelog-1.11.8] [source: https://github.com/hashicorp/nomad/releases/tag/ent-changelog-1.10.14]

Terraform's 1.16 alpha track added resource action on_failure modes. Resources using create_before_destroy or other action triggers can now specify halt, taint, or continue on failure. The alpha also shipped the store block in terraform_data for ephemeral and sensitive values, provider support for nested blocks as computed values, and import blocks inside modules. The 1.15 stable line saw 1.15.8, fixing a terraform init error with service-discovery aliases from the configured backend. [source: https://github.com/hashicorp/terraform/releases/tag/v1.16.0-alpha20260708] [source: https://github.com/hashicorp/terraform/releases/tag/v1.15.8]

Consul 2.0.2 upgraded Alpine base and hardened Envoy inbound listeners. Alpine moved to 3.24 to address CVEs. Envoy inbound public listeners now return errors when injection of the L4 intention filter or mTLS transport socket fails, preventing listeners served without intention enforcement or mTLS. Enterprise-only external processor (ext_proc) Envoy extension support was added to api-gateway and connect-proxy config entries. [source: https://github.com/hashicorp/consul/releases/tag/v2.0.2]