HashiCorp Consul-template Path Redirection Vulnerability Advisory (CVE-2026-14361)

Vulnerability Overview HCSEC-2026-20 - Consul-template vulnerable to path redirections in writeToFile Vulnerability ID: HCSEC-2026-20 Published Date: July 8, 2026 Affected Products/Versions: consul-template up to and including version 0.42.0; the fixed version is 0.42.1 Vulnerability Description: - The consul-template library contains a path traversal vulnerability prior to version 0.42.1, which allows template output to be written outside the intended directory or overwrite existing files. - This vulnerability (CVE-2026-14361) has been fixed in consul-template version 0.42.1. Impact Scope Background: - The template function writes rendered template content to a local file, creating the parent directory if it does not exist, and applying the configured owner, group, and permissions. It is commonly used to persist rendered output, including certificate and private key material, to operator-specified paths. Details: - The helper opens the target path directly and follows symbolic links, directory links, and similar filesystem redirections, rather than resolving and validating the final destination before writing. If an attacker can pre-stage such links or position them beneath the target path prior to the write operation, the helper will write rendered content to the redirected location. This may result in writing outside the operator's expected directory and can overwrite pre-existing files at that location. Exploitation requires sufficient local access to create or modify path components. The impact is greater when consul-template runs with elevated privileges or writes sensitive material such as keys and certificates. Remediation Mitigation: - Customers should assess the risk associated with this issue and consider upgrading to consul-template 0.42.1. Acknowledgments This issue was reported to HashiCorp by Mohamed Abdelaal (0xmma). Related Topics HCSEC-2026-12 - Consul-template vulnerable to sandbox path bypass in file helper through symlink attack Consul Template v0.25.1 Consul-Template v0.28.0 HCSEC-2022-16 - Consul Template May Expose Vault Secrets When Processing Invalid Input Consul-Template v0.28.1 Additional Page Information Views: 36 Replies: None Activity Time: 9 hours ago Navigation Bar and Ads Skip navigation bar, ads, and footer. Code Block No POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

HashiCorp Consul-template Path Redirection Vulnerability Advisory (CVE-2026-14361)