CVE-2026-87993: high-severity vulnerability in HashiCorp Tooling
Consul-template vulnerable to an information disclosure issue in error handling
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.4%
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
HashiCorp · ToolingRelated CVEs — HashiCorp Tooling
In the same product, most dangerous first.
CVE-2026-4660HIGHGo-getter may allow to arbitrary filesystem reads through git operationsEPSS 0.6%CVE-2026-16326CRITICALconsul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeEPSS 0.5%CVE-2025-13357HIGHVault Terraform Provider Applied Incorrect Defaults for LDAP Auth MethodEPSS 0.5%CVE-2026-8715CRITICALVault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPathEPSS 0.5%CVE-2026-16498CRITICALterraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeEPSS 0.5%CVE-2026-16328HIGHconsul-mcp-server vulnerable to server side request forgery leading to token exposureEPSS 0.4%