CVE-2026-87993

HighCVSS 7.7

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events.

Risk Assessment

Confidential Vault secret values may leak into logs and other surfaces, potentially leading to unauthorized access to protected resources.

Recommendation

Upgrade consul-template to version 0.43.0 or newer.

Other vulnerabilities in consul-template

CVE-2026-14361Medium
The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper, which may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability is fixed in consul-template 0.42.1.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS