CVE-2026-14361: Path Traversal in Consul-Template writeToFile

Technical summary

CVE-2026-14361 is a path traversal vulnerability (CWE-59) in the writeToFile function of consul-template. The vulnerability stems from insufficient path validation when the template helper writes rendered template output to files. An authenticated local user with privileges to supply or modify templates could use relative paths, symlinks, or directory traversal sequences to redirect writes outside the intended sandbox directory. The CVSS 3.1 score of 4.7 (Medium severity) reflects the local attack vector, high complexity requirement, and the confidentiality impact from potential file access patterns, though integrity is not scored as compromised in this vector.

Business impact

Organizations using consul-template for configuration management or secrets distribution face a moderate risk: a local attacker or compromised service account could modify system files or configuration owned by the consul-template process. This could lead to privilege escalation, denial of service, or unauthorized configuration changes. The impact is constrained to systems where template modification is possible and where the consul-template process runs with meaningful privileges. Most organizations using consul-template in standard HashiCorp Consul deployments mitigate this naturally through process isolation and strict file permissions.

Affected systems

Consul-template library versions prior to 0.42.1 are affected. This includes all 0.42.0 and earlier releases. Organizations should inventory consul-template instances via dependency scanning or by checking version output from consul-template -version. The vulnerability does not affect Consul server or client agents directly; it only impacts deployments that consume the consul-template library as a dependency or use it as a standalone binary for template rendering.

Exploitability

Exploitation requires local system access and the ability to either create or modify a consul-template configuration file or template. The CVSS vector AC:H (high complexity) indicates that successful exploitation is not straightforward—it typically requires control over template content or knowledge of file system layout. Remote exploitation is not possible. This is a practical concern in environments where untrusted users or service accounts can influence template definitions, or where templates are dynamically sourced from untrusted input.

Remediation

Upgrade consul-template to version 0.42.1 or later. For organizations unable to upgrade immediately, restrict local access to systems running consul-template and limit which principals can create or modify template configurations. Review any process running consul-template and ensure it operates with the minimum necessary file system permissions. Audit template sources to confirm they are from trusted origins only.

Patch guidance

Apply the upgrade to consul-template 0.42.1 as soon as feasible. This is a straightforward version bump with no known breaking changes in the patch release. Verify the upgrade by running consul-template -version to confirm 0.42.1 or later is active. If consul-template is vendored into a larger application, check that application's release notes for inclusion of the patched library version. No configuration changes are required post-upgrade.

Detection guidance

Monitor file system activity for unexpected writes or overwrites by consul-template processes, particularly writes outside intended template output directories. Look for error logs from consul-template indicating permission denied errors or file write failures, which may indicate attempted exploitation. Audit changes to system files or sensitive configuration files that coincide with consul-template execution. If templates are dynamically loaded, log and alert on modifications to template sources before rendering.

Why prioritize this

This vulnerability should be prioritized based on your environment's use of consul-template and the privileges under which it runs. If consul-template runs as a limited service account on isolated systems where templates are carefully controlled, risk is low. Prioritize patching if: (1) consul-template runs with elevated privileges, (2) local users have permission to modify templates, or (3) templates are sourced from partially untrusted sources. The medium CVSS score and local-only attack vector make this lower priority than remote code execution risks, but it is not negligible in high-privilege or high-trust scenarios.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects: Local attack vector (AV:L) indicating no remote exploitation path; High complexity (AC:H) because successful exploitation requires significant preconditions; Low privileges (PR:L) because a local user can attempt the attack; and High confidentiality impact (C:H) because an attacker could read files written to or accessed during exploitation. Integrity and availability are not scored as impacted under this vector, lowering the overall score. The Medium severity classification is appropriate for a local privilege escalation vector with moderate practical impact.

Frequently asked questions