HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling

Bulletin ID: HCSEC-2026-38 Affected Products / Versions: consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0 Publication Date: September 10, 2026 Summary The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0. Background Consul-template renders Vault secrets into configuration files using a templating engine. When a template expression encounters an error, consul-template attempts to redact any known secret values from the error message before writing it to logs or returning it to the caller. This redaction mechanism is intended to prevent secret values from appearing in error output even when a template fails to render. Details The secret redaction mechanism did not correctly handle all Vault secret response shapes, causing certain secret field values to escape redaction and appear verbatim in template error messages. These messages may be written to logs and, when consul-template is used with Nomad, may be included in task events accessible to callers with job-read permissions. Deployments using only Vault KV v1 secrets are not affected by this issue. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to consul-template 0.43.0. Acknowledgement This issue was reported to HashiCorp by Ali Firas (thesmartshadow). We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security. 1 post - 1 participant Read full topic