CVE-2026-87993: Consul Vulnerable to Information Disclosure in Error Handling
Summary
CVE-2026-87993: Consul-template vulnerable to an information disclosure issue in error handling. Affects consul versions >= 0.27.2, < 0.43.0. Fixed in 0.43.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Consul is a widely used tool for service discovery and configuration management, developed by HashiCorp. It enables users to manage services in a distributed system, providing features such as health checking, key-value storage, and service segmentation. The consul-template library, which integrates with Consul, allows users to generate configuration files and other artifacts from templates using data from Consul and Vault. However, it has been found to be vulnerable to an information disclosure issue that could expose sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2026-87993 in the consul-template library arises from improper error handling. When errors occur during template processing, sensitive Vault secret values may inadvertently be included in error messages, log outputs, and Nomad task events. This could lead to unauthorized access to sensitive information, posing a significant security risk to applications relying on these secrets.
How To Fix
Minimum fixed version
0.43.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement logging controls to filter out sensitive information from logs and error messages. This can be done by modifying the logging configuration to exclude specific patterns that may contain Vault secrets.
Conclusion
CVE-2026-87993 highlights a critical information disclosure vulnerability in the consul-template library, which can expose sensitive Vault secrets through error handling. It is essential for users to update to version 0.43.0 or later to mitigate this risk. Additionally, implementing logging controls can serve as a temporary measure until the update is applied.
See every vulnerability recorded for consul →
FAQ
CVE-2026-87993 is a vulnerability in the consul-template library that allows sensitive Vault secret values to be exposed through error messages and logs.
If your application uses consul-template and encounters errors, it may inadvertently log sensitive information, leading to potential data breaches.
Versions of consul-template prior to 0.43.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement logging controls to prevent sensitive information from being logged as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for consul.
