CVE-2026-87993

consul-template versions before 0.43.0 contain an information disclosure flaw (CWE-532): when template rendering fails, the error handling path can embed interpolated Vault secret values directly in the resulting error message. Anyone who can trigger a template error and view the output — console output, log files, or downstream surfaces such as Nomad task events — can read otherwise-protected Vault secret values from that message. The impact is secret exposure to holders of log/event read access rather than remote compromise, which is consistent with the CVSS 7.7 score (low privileges required, high confidentiality impact only, scope changed because secrets leak across a boundary into Nomad task events). Affected are users running consul-template prior to 0.43.0 with Vault-backed templates, including deployments where Nomad renders templates and surfaces errors as task events. No public proof-of-concept, CISA KEV listing, or reports of in-the-wild exploitation are known; the fix is available in consul-template 0.43.0.

What to do: Upgrade all consul-template installations to 0.43.0 or later, and check for bundled/embedded copies used with Nomad or other integrations, updating them per HashiCorp guidance. Until upgraded, restrict read access to template error logs and Nomad task events, avoid logging full template errors at verbose levels, and review recent log/event history to identify and rotate any Vault secrets that may have been rendered into error messages.