HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling

Published September 10, 2026 CVE-2026-87993

HashiCorp consul-template can accidentally reveal Vault secret values in error messages and logs. Nomad users may also see those values in task events.

Severity
HighCVSS 3.1 · 7.7
Fix
Fixed in 0.43.0
Affected versions
0.27.2 to before 0.43.0
Weakness
CWE-532Sensitive Information in Log File
Exploit likelihood
0.28% in 30 daysEPSS, higher than 20% of known flaws
Affects
Tooling
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75701ENISA vulnerability database

How it works

  • When a template expression encounters an error, consul-template tries to hide known Vault secret values.
  • Its redaction does not handle every Vault response format, so some secret fields can appear in error messages.
  • Those messages may enter logs or Nomad task events visible to callers with job-read permissions.
  • The advisory does not explain how an attacker causes the template error.

What to do

Check the consul-template version used by each deployment and compare it with HashiCorp's advisory. Versions 0.27.2 through 0.42.1 are affected, while deployments using only Vault KV v1 secrets are not affected.

Upgrade affected deployments to consul-template 0.43.0 or later, following HashiCorp's documented remediation. Review relevant logs and Nomad task events for exposed Vault values.

Technical details

Affected software: Toolingby HashiCorp

CVE-2026-87993 affects consul-template's handling of template errors. Certain Vault response formats can bypass secret redaction, exposing field values in errors, logs, and Nomad task events. HashiCorp identifies 0.27.2 through 0.42.1 as affected and 0.43.0 as fixed.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source