EUVD-2026-75701
GHSA-h4cr-56m4-rqc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrigger consul-template rendering error (bad path/type)
-
DeliveryError handler serializes Vault secret into error string
-
ExploitError emitted to Nomad task events and logs
-
ExecutionAttacker reads task events with Nomad operator credentials
-
ImpactVault secret value extracted from error output
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Requires consul-template to be deployed in Vault integration mode (i.e., templates reference Vault secret paths via the secret or with secret template functions). A template rendering error must occur - caused by a misconfigured template, missing Vault path, wrong data type, or transient Vault unavailability. The attacker then needs read access to a downstream surface that receives the error output: Nomad task event history, a log aggregation system, or consul-template's stderr. PR:L (low privileges) reflects that Nomad operator-level access suffices to read task events. Exploitation is limited to deployments where consul-template is integrated with Vault; deployments using consul-template exclusively with Consul KV or environment variables are not affected by the Vault-secret disclosure aspect. |
| Impact | The vendor-supplied CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) is well-calibrated for this class of issue. PR:L correctly reflects that triggering or observing the error requires some operational access - a Nomad job submitter or operator with task-event read access fits this profile. The S:C (scope changed) metric captures the key real-world risk: Vault secrets intended to be ephemeral and privilege-gated instead persist in Nomad event history and log aggregation systems (e.g., Splunk, Elasticsearch) where retention policies and RBAC differ from Vault's own access controls. No public exploit code exists and the vulnerability is not in CISA KEV, making this a low-urgency but meaningful hygiene patch - particularly for organizations where Vault stores high-value secrets (database credentials, cloud API keys) and Nomad task events are accessible to a broader operator tier than Vault itself. |
| Exploit ScenarioDerived | A Nomad operator with job-submission privileges submits a job that uses a consul-template rendering a Vault KV secret path that contains a typo or refers to a missing secret. consul-template encounters a rendering error, serializes the resolved (but partial) Vault secret values into the error message, and Nomad records this error in the task events API. A second operator - with Nomad read access but without Vault policy grants for that secret - queries the Nomad task events and reads the Vault secret value in plain text from the error output. No public exploit code exists for this issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to improper error handling. The vulnerability affects consul-template deployments integrated with HashiCorp Vault, where a template rendering error can inadvertently expose secret values to any downstream surface that receives error text - including Nomad task event logs readable by lower-privileged operators. The scope-changed CVSS vector (S:C) reflects that the primary harm falls on systems outside consul-template itself: Vault secrets meant to be accessed only by privileged services instead persist in Nomad task events and logging infrastructure accessible to broader audiences.
RemediationAI
Upgrade consul-template to version 0.43.0 or later, as confirmed by the HashiCorp advisory at https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740. If an immediate upgrade is not possible, restrict read access to Nomad task events and structured logs to only those principals who already have equivalent Vault access - this reduces the blast radius by aligning log visibility with Vault policy. Additionally, enable Vault audit logging to detect any secret values that may have already leaked into log streams and rotate credentials for secrets associated with templates that have historically produced rendering errors. Note that restricting log access is a compensating control only; it does not prevent the secrets from being written to logs in the first place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
consul-template is HashiCorp's daemon that watches Vault (and Consul/Nomad) for data changes and dynamically renders configuration templates. CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: when the template rendering pipeline encounters an error - such as a missing Vault path, type mismatch, or malformed template - the error handler serializes the rendering context including resolved Vault secret values into the error string, which is then emitted to stderr, structured logs, and Nomad's task event API. The CPE supplied (cpe:2.3:a:hashicorp:tooling:*:*:*:*:*:*:*:*) is a generic placeholder; the actual affected product is the hashicorp/consul-template binary and library, fixed at version 0.43.0.
Know when Tooling gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
PR:L reflects Nomad operator access needed to trigger or read errors; S:C because Vault secrets escape into Nomad and log systems outside consul-template's security scope.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
2DescriptionCVE.org
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.
Articles & Coverage 2
Executive ViewAI
HashiCorp consul-template exposes Vault secrets in error logs and Nomad task events, allowing lower-privileged infrastructure operators to access credentials intended only for privileged services. For organizations running Vault with Nomad orchestration, this creates a privilege escalation path that compromises all secrets stored in Vault. Rapid inventory and remediation is required to prevent credential theft and lateral movement.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict RBAC access to Nomad task event logs to administrators only; implement log redaction or filtering to mask error messages containing secrets; rotate Vault secrets currently exposed; increase Vault audit logging to detect unauthorized credential usage; consider isolating consul-template in containers with restricted log output; disable error logging if the application supports alternative error handling.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Cross-namespace authorization bypass in HashiCorp consul-k8s 0.42.0 and later can let an attacker with an existing low-p
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Exploit-DB