CVE-2026-14361: Consul-Template Path Traversal Flaw

CVE-2026-14361 Overview

CVE-2026-14361 is a path redirection vulnerability in HashiCorp's consul-template library affecting versions prior to 0.42.1. The flaw resides in the writeToFile template helper, which fails to prevent redirection of template output to unintended locations. An attacker with the ability to influence template content can write output outside the intended directory or overwrite existing files. The issue is tracked under CWE-59: Link Following and is addressed in consul-template 0.42.1.

Critical Impact
A local actor able to control template inputs can redirect file writes outside the configured destination directory, potentially overwriting sensitive files on the host.

Affected Products

HashiCorp consul-template versions prior to 0.42.1
Systems using consul-template to render configuration from Consul or Vault data
Automation pipelines depending on the writeToFile template helper

Discovery Timeline

2026-07-08 - CVE-2026-14361 published to NVD
2026-07-08 - Last updated in NVD database
2026-07-08 - HashiCorp publishes advisory HCSEC-2026-20

Technical Details for CVE-2026-14361

Vulnerability Analysis

The consul-template library renders templates using values from Consul, Vault, and other sources. Templates can call the writeToFile helper to persist rendered output to a designated path. In vulnerable releases, the helper does not adequately validate or canonicalize the destination path before opening the target file. As a result, symbolic links or crafted relative path components in the file argument can redirect the write to a location outside the intended output directory.

Exploitation requires local access and the ability to influence template content or the file path passed to writeToFile. Because the process typically runs with elevated privileges to write configuration files, redirection can overwrite files owned by more privileged users or system services.

Root Cause

The root cause is insufficient path handling in the writeToFile template helper. The function follows symbolic links and does not enforce that the resolved path remains within a permitted directory boundary. This falls under CWE-59: Improper Link Resolution Before File Access.

Attack Vector

An attacker with local access and control over template content or the file path arguments used with writeToFile places a symlink at the expected output location or supplies a path traversal sequence. When consul-template renders the template, the helper follows the redirection and writes output to the attacker-chosen destination, overwriting the file. See the HashiCorp Security Advisory HCSEC-2026-20 for vendor detail.

Detection Methods for CVE-2026-14361

Indicators of Compromise

Unexpected modification timestamps on system configuration files written by processes running consul-template.
Symbolic links present in directories used as writeToFile destinations that point to files outside those directories.
Template definitions containing suspicious relative paths such as ../ sequences or absolute paths outside the configured output root.

Detection Strategies

Audit template repositories and configuration for calls to writeToFile that accept untrusted path arguments.
Compare deployed consul-template binary versions against 0.42.1 across all hosts running the agent.
Enable file integrity monitoring on directories written by consul-template and on adjacent sensitive paths such as /etc and service configuration folders.

Monitoring Recommendations

Log and alert on file writes performed by the consul-template process outside its configured destination directories.
Monitor creation of symbolic links inside directories used as consul-template output paths.
Track template rendering errors and permission-denied events that may indicate probing of the writeToFile helper.

How to Mitigate CVE-2026-14361

Immediate Actions Required

Upgrade consul-template to version 0.42.1 or later on all hosts.
Restrict write permissions on directories used as writeToFile targets so only the consul-template service account can modify them.
Review and sanitize all templates that call writeToFile with dynamic path values.

Patch Information

HashiCorp fixed the vulnerability in consul-template 0.42.1. Refer to the HashiCorp Security Advisory HCSEC-2026-20 for release notes and upgrade guidance.

Workarounds

Run consul-template as a low-privilege user with write access limited strictly to intended output directories.
Remove or replace symbolic links inside writeToFile destination directories and disallow their creation.
Avoid supplying user- or template-controlled values to the file parameter of writeToFile; use static, vetted paths.

bash

# Verify installed version and upgrade if below 0.42.1
consul-template -v
# Example upgrade on Linux (adjust for package manager or download source)
curl -O https://releases.hashicorp.com/consul-template/0.42.1/consul-template_0.42.1_linux_amd64.zip
unzip consul-template_0.42.1_linux_amd64.zip
sudo mv consul-template /usr/local/bin/consul-template
sudo chmod 755 /usr/local/bin/consul-template