CVE-2026-87993

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-87993

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87993.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-87993

Published

2026-09-10T19:00:08Z

Modified

2026-09-12T03:47:22Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

Consul-template vulnerable to an information disclosure issue in error handling

Details

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

Database specific

{
    "cna_assigner": "HashiCorp",
    "cwe_ids": [
        "CWE-532"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87993.json"
}

References

Affected packages

Git / github.com/hashicorp/consul-template

Affected ranges

Type

GIT

Repo

https://github.com/hashicorp/consul-template

Events

Introduced

0400fa21081d44bd8aeccf858f093c2fe13d7774

Fixed

47984bdf50d35f8cb010e65369f96789c1b34957

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.27.2"
        },
        {
            "fixed": "0.43.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.27.2

v0.28.0

v0.29.0

v0.29.1

v0.29.2

v0.29.3

v0.29.4

v0.29.5

v0.29.6

v0.30.0

v0.31.0

v0.32.0

v0.33.0

v0.34.0

v0.35.0

v0.36.0

v0.37.0

v0.37.1

v0.37.2

v0.37.3

v0.37.4

v0.37.5

v0.37.6

v0.38.0

v0.38.1

v0.39.0

v0.39.1

v0.40.0

v0.41.2

v0.41.3

v0.41.4

v0.42.0

v0.42.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87993.json"