EUVD-2026-42346
GHSA-xcm7-pmg9-8wjq
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and high complexity required for symlink race; I:L added because description explicitly states existing files can be overwritten, which the vendor's I:N underweights.
Primary rating from Vendor (hashicorp).
CVSS VectorVendor: hashicorp
Lifecycle Timeline
2DescriptionCVE.org
The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.
AnalysisAI
Path redirection via the writeToFile template helper in consul-template before 0.42.1 allows a local low-privileged attacker to redirect template output outside the intended destination directory or overwrite existing files on the filesystem. Because consul-template routinely renders sensitive secrets from HashiCorp Vault, Consul, and AWS Secrets Manager into local files, successful exploitation can expose those secrets by redirecting writes to attacker-readable locations. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Technical ContextAI
consul-template is a HashiCorp daemon that watches dynamic secret stores (Vault, Consul KV, AWS Secrets Manager) and renders Go templates to files on disk. The writeToFile template helper accepts a destination path and writes rendered template output to that path. CWE-59 (Improper Link Resolution Before File Access, 'Link Following') identifies the root cause: the library fails to canonicalize or validate the resolved destination path before performing the write, allowing a symlink or relative traversal sequence to redirect the write operation outside the intended directory boundary. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is local, requires low OS-level privileges, and involves high complexity - consistent with a race condition or a preconditioned symbolic link attack on the target path prior to consul-template's write operation. No CPE strings were provided in the input data; the affected software is the consul-template library developed and maintained by HashiCorp.
RemediationAI
Upgrade consul-template to version 0.42.1 or later, which contains the vendor-released fix for this vulnerability per HashiCorp advisory HCSEC-2026-20 (https://discuss.hashicorp.com/t/hcsec-2026-20-consul-template-vulnerable-to-path-redirections-in-writetofile/77559). If an immediate upgrade is not feasible, consider restricting the OS filesystem permissions of the directory into which consul-template writes, ensuring that no unprivileged local users can create symlinks or alter directory entries in that path - this disrupts the symlink-following attack precondition at the OS level. Additionally, enabling fs.protected_symlinks=1 on Linux (if not already set) prevents unprivileged processes from following symlinks in sticky world-writable directories, reducing the attack surface. Note that the path restriction workaround does not fully eliminate the risk if consul-template directories are shared or world-writable by design.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today