CVE-2026-87993: Consul-template vulnerable to an information disclosure issue in error handling
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
consul-templateto a version that resolves this vulnerability.Fixed in 0.43.0Patch CVE-2026-87993
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges sufficient to cause or influence a consul-template error path involving Vault-backed template data, or access to the resulting error messages, logs, or downstream surfaces such as Nomad task events. The vulnerability is network-reachable and requires low privileges; no user interaction is required.
What versions are fixed?
The issue is fixed in consul-template 0.43.0. The provided information does not identify the first affected version or whether any particular deployment configuration is unaffected.
Where should teams look for possible secret exposure?
Review consul-template template error messages and log output, and inspect downstream consumers of those errors, including Nomad task events. Vault secret values may have been included in these surfaces when the vulnerable error-handling path was triggered.