The consul-template library contains an information disclosure vulnerability (CWE-532) in its error handling mechanism. When errors occur, Vault secret values may be inadvertently included in template error messages, log files, and downstream surfaces like Nomad task events. This could lead to unauthorized exposure of sensitive secrets. The vulnerability is identified as CVE-2026-87993 and has a CVSS 3.1 base score of 7.7, indicating high severity. The issue affects versions from 0.27.2 up to but not including 0.43.0. The vulnerability has been fixed in consul-template version 0.43.0.

Sensitive Vault secret values may be exposed in logs, error messages, and downstream outputs, potentially allowing unauthorized users with access to these logs or outputs to obtain confidential information. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability requires network access with low privileges and no user interaction.

Upgrade consul-template to version 0.43.0 or later, where this vulnerability is fixed. No other mitigation is indicated or required by the vendor advisory.