CVE-2026-5061: Consul-Template Path Traversal Vulnerability

CVE-2026-5061 Overview

CVE-2026-5061 is a sandbox path bypass vulnerability in HashiCorp's consul-template library before version 0.42.0. The flaw resides in the file template helper function, which fails to properly validate symbolic links when resolving file paths. An attacker with local access and limited privileges can craft a symlink that points outside the configured sandbox directory. When consul-template processes the helper, it follows the symlink and reads files outside the intended boundary. This vulnerability is classified under CWE-59: Improper Link Resolution Before File Access. HashiCorp addressed the issue in consul-template version 0.42.0.

Critical Impact
Local attackers can read sensitive files outside the configured sandbox boundary, exposing secrets, credentials, or configuration data processed by consul-template.

Affected Products

HashiCorp consul-template library versions prior to 0.42.0
Applications and services embedding vulnerable consul-template versions
HashiCorp Consul deployments leveraging template rendering with the file helper

Discovery Timeline

2026-05-12 - CVE-2026-5061 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-5061

Vulnerability Analysis

The vulnerability is a symlink-based sandbox escape in the consul-template file template helper. consul-template renders configuration files by executing helper functions inside templates, including a helper that reads file contents from disk. The helper is intended to enforce a sandbox directory, restricting file reads to paths within an approved boundary.

The sandbox check resolves the requested path against the allowed directory but does not adequately handle symbolic links located inside that directory. An attacker who can place a symlink within the sandbox path can point that symlink at any file the running process is permitted to read. When the helper opens the symlink target, the contents are returned to the template renderer and may be written into rendered output, logs, or downstream configuration.

The CWE classification [CWE-59] reflects an Improper Link Resolution Before File Access weakness, a category that also covers classic Time-of-Check Time-of-Use (TOCTOU) symlink races.

Root Cause

The root cause is insufficient path canonicalization in the file helper. The sandbox enforcement validates the supplied path string rather than resolving the final on-disk target after following symlinks. As a result, a path that appears to live inside the sandbox can transparently dereference to an arbitrary file on the local filesystem.

Attack Vector

Exploitation requires local access and the ability to write a symlink into the consul-template sandbox directory. The attacker creates a symlink whose target is a sensitive file outside the sandbox, such as /etc/shadow, private keys, or application secrets. When consul-template renders a template referencing that path via the file helper, the helper follows the symlink and exposes the target file's contents through the rendered template output.

The attack complexity is high because the attacker must already have file write access to a location inside the sandbox and must wait for or trigger a template rendering event. Technical details and the vendor advisory are available in the HashiCorp Security Advisory HCSEC-2026-12.

Detection Methods for CVE-2026-5061

Indicators of Compromise

Unexpected symbolic links inside directories configured as the consul-template sandbox root
Rendered template output containing contents of sensitive system files such as /etc/shadow, SSH keys, or token files
File access events from the consul-template process touching paths outside its configured sandbox directory

Detection Strategies

Audit filesystem events on consul-template sandbox directories for symlink() and symlinkat() syscalls originating from non-administrative users
Compare the configured sandbox path with the resolved canonical paths accessed by the consul-template binary using tools such as auditd or eBPF tracing
Inspect generated configuration artifacts for unexpected content that matches known sensitive file signatures

Monitoring Recommendations

Enable filesystem auditing on hosts running consul-template and alert on symlink creation in template source directories
Centralize consul-template logs and monitor for repeated file helper invocations referencing unusual paths
Track the deployed consul-template version across the fleet and flag any host still running a release prior to 0.42.0

How to Mitigate CVE-2026-5061

Immediate Actions Required

Upgrade all consul-template deployments to version 0.42.0 or later
Inventory every system, container image, and embedded distribution that bundles consul-template and confirm patched versions are in use
Restrict write access to template sandbox directories so only trusted automation accounts can create files or symlinks
Rotate any secrets that may have been exposed through rendered templates on vulnerable hosts

Patch Information

HashiCorp resolved CVE-2026-5061 in consul-template0.42.0. The fix updates the file helper to properly resolve symbolic links and reject any path whose canonical target falls outside the configured sandbox. Refer to the HashiCorp Security Advisory HCSEC-2026-12 for complete release details.

Workarounds

Run consul-template under a dedicated low-privilege user that cannot read sensitive system files such as /etc/shadow or private keys
Mount the sandbox directory on a filesystem with nosymfollow semantics or enforce equivalent restrictions through mandatory access control policies
Deny write access to the sandbox directory for any account other than the consul-template service identity to prevent attacker-controlled symlinks

bash

# Configuration example: verify and upgrade consul-template
consul-template -v
# Upgrade to fixed version
wget https://releases.hashicorp.com/consul-template/0.42.0/consul-template_0.42.0_linux_amd64.zip
unzip consul-template_0.42.0_linux_amd64.zip
install -m 0755 consul-template /usr/local/bin/consul-template

# Restrict sandbox directory permissions
chown consul-template:consul-template /var/lib/consul-template/sandbox
chmod 0750 /var/lib/consul-template/sandbox