HashiCorp security advisory (AV26-910)

Published September 11, 2026

HashiCorp's Consul and consul-template tools have flaws that let attackers crash the service or run commands on your servers if they can trick you into opening a malicious file. These flaws affect older versions of Consul and consul-template.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 2.0.4
Exploited
Not confirmedNo confirmation recorded

How it works

  • An attacker sends a specially crafted file to Consul or consul-template.
  • When you open it, the program crashes or lets the attacker run commands on your server.
  • This happens because the software does not safely handle certain file types.

What to do

If you use HashiCorp Consul before version 2.0.4, Consul Enterprise 1.0 before 1.21.18, Consul Enterprise 21.0 before 1.21.18, Consul Enterprise 9.0 before 1.21.18, or consul-template before 0.43.0, check your installed version by running consul version or consul-template --version. Compare the output against the fixed versions listed above.

Update Consul to 2.0.4 or later, Consul Enterprise to 1.21.18 or later, or consul-template to 0.43.0 or later. Follow HashiCorp's official update guides for your version. Verify the update by re-running the version command and confirming the new version number.

Technical details

HashiCorp disclosed two vulnerabilities in Consul and consul-template that allow unauthorized access to sensitive data. The first, affecting Consul versions before 2.0.4 and Consul Enterprise 1.0 before 1.21.18 (including 21.0 and 9.0 before 1.21.18), enables attackers to bypass authentication and read or modify configuration data by exploiting an improper input validation flaw. The second, in consul-template before 0.43.0, allows template injection, letting attackers execute arbitrary commands on the host system via maliciously crafted input.

Both issues were reported under internal tracking ID NEWS-035edac11b5716f298. Updates to the specified versions resolve the vulnerabilities.

References

View Original Source