EUVD-2026-75701
GHSA-h4cr-56m4-rqc8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
PR:L reflects Nomad operator access needed to trigger or read errors; S:C because Vault secrets escape into Nomad and log systems outside consul-template's security scope.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.
Articles & Coverage 2
AnalysisAI
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to improper error handling. The vulnerability affects consul-template deployments integrated with HashiCorp Vault, where a template rendering error can inadvertently expose secret values to any downstream surface that receives error text - including Nomad task event logs readable by lower-privileged operators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires consul-template to be deployed in Vault integration mode (i.e., templates reference Vault secret paths via the secret or with secret template functions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) is well-calibrated for this class of issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade consul-template to version 0.43.0 or later, as confirmed by the HashiCorp advisory at https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all consul-template deployments integrated with Vault and Nomad; search Nomad task events and system logs for evidence that Vault secrets have appeared in error messages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today