CVE-2026-5061
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper, potentially allowing reading of a file outside the sandbox. This vulnerability is fixed in consul-template 0.42.0.
Risk Assessment
An attacker able to influence templates may read files outside the permitted directory, potentially exposing sensitive data such as secrets or configurations. This may lead to privilege escalation or information leakage.
Recommendation
Update consul-template to version 0.42.0 or later. Restrict template modification to trusted users and review configurations for unauthorized changes.
Other vulnerabilities in consul-template
See all- CVE-2026-87993High
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events.
- CVE-2026-14361Medium
The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper, which may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability is fixed in consul-template 0.42.1.
Original NVD description (English source)
The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS