HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling

{
  "id": "9de540c5b9f2305fecc259ab8b3d249244ccedc54b15fc85505e646fc1cb7e9e",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling",
    "summary": "Consul-template may expose Vault secret values in template error messages, logs, and downstream surfaces such as Nomad task events. Deployments using only Vault KV v1 secrets are not affected. Customers should consider upgrading to the fixed version.",
    "evidence": "The secret redaction mechanism did not correctly handle all Vault secret response shapes, causing certain secret field values to escape redaction and appear verbatim in template error messages.",
    "products": [
      {
        "name": {
          "value": "consul-template",
          "evidence": "consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0"
        },
        "prerequisites": [
          {
            "value": "Deployments using only Vault KV v1 secrets are not affected by this issue.",
            "evidence": "Deployments using only Vault KV v1 secrets are not affected by this issue."
          }
        ],
        "fixed_versions": [
          {
            "value": "0.43.0",
            "evidence": "consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0"
          }
        ],
        "affected_versions": [
          {
            "value": "0.27.2 through 0.42.1",
            "evidence": "consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-87993",
        "product": "consul-template",
        "evidence": "This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-87993",
        "evidence": "This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24004,
  "published_at": "2026-09-10T18:51:37+00:00"
}