CVE-2026-87993

Consul-template vulnerable to an information disclosure issue in error handling

At a glance

Severity: HIGH 7.7
EPSS: EPSS 0.38 % · percentile 32 (2026-10-27)
State: PUBLISHED
Published: 2026-09-10
Updated: 2026-09-10
Assigner: HashiCorp
NVD status: Awaiting Analysis

Description

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	HashiCorp
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	NVD · security@hashicorp.com (Secondary)

Weaknesses (CWE)

CWE-532

European references

ENISA EUVD · EUVD-2026-75701
GCVE · GCVE-0-2026-87993

Affected products

Product	Versions
HashiCorp · Tooling	affected 0.27.2 < 0.43.0

References

https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD