consul-template EUVD-2026-29483

Exploitation requires: (1) local system access with valid user authentication (PR:L per CVSS vector), (2) ability to create symbolic links in or near the template working directory, (3) knowledge of the sandbox boundary or file paths to be exfiltrated, and (4) the file template helper must be in use by the consul-template configuration. Exploitation does NOT require network access or user interaction (AC:H reflects the deliberate symlink setup required rather than automatic trigger). Environments where only trusted administrators have local access, where filesystem permissions prevent symlink creation, or where the file template helper is not used are not affected.

CVSS 4.7 with local attack vector (AV:L), high complexity (AC:H), and low privilege requirement (PR:L) indicates moderate real-world risk. The vulnerability is limited to authenticated local users and requires deliberate symlink manipulation, reducing spontaneous exploitation likelihood. High confidentiality impact (C:H) is significant for environments where sensitive files are co-located with templates. Absence of EPSS score, KEV status, and POC data in provided intelligence means active exploitation is not confirmed; however, symlink-based sandbox bypasses are a known attack pattern. Risk is primarily relevant to environments where untrusted local users share access to consul-template instances or where template rendering is exposed to local privilege escalation chains. The high complexity requirement (AC:H) suggests an attacker must either craft specific filesystem conditions or possess detailed knowledge of the sandbox implementation, limiting opportunistic exploitation.

A local authenticated user with low privileges on a system running consul-template creates a symbolic link within or accessible to the template sandbox that points to a sensitive file outside the sandbox (e.g., /etc/passwd or application configuration containing credentials). When the file template helper processes the symlink, the insufficient link resolution validation allows the user to read the out-of-sandbox file content, bypassing the intended sandbox restriction.