CVE-2022-38149
HashiCorp Consul Template could reveal Vault secret contents in error messages
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
- Record
CVE-2022-38149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
CVE List No score
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
- Record
CVE-2022-38149- Updated
- 2026-11-02
EUVDEUVD-2022-6511 No score
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
- Record
EUVD-2022-6511- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8449-7gc2-pwrp
HashiCorp Consul Template could reveal Vault secret contents in error messages
In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the *template.Template.Execute 5 method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.
- Record
GHSA-8449-7gc2-pwrp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-38149
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
- Record
ALPINE-CVE-2022-38149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVGHSA-8449-7gc2-pwrp
HashiCorp Consul Template could reveal Vault secret contents in error messages
In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the *template.Template.Execute 5 method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.
- Record
GHSA-8449-7gc2-pwrp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV No score
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
- Record
CVE-2022-38149- Updated
- 2026-11-02
OSVGO-2022-0980 No score
Exposure of Vault secrets via error messages in github.com/hashicorp/consul-template
The text of errors returned by Template.Execute can contain Vault secrets, potentially revealing these secrets in logs or error reports.
- Record
GO-2022-0980- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hashicorp/consul-templateGo |
before 0.27.3 | 0.27.3 |
github.com/hashicorp/consul-templateGo |
0.28.0 up to 0.28.3 | 0.28.3 |
github.com/hashicorp/consul-templateGo |
0.29.0 up to 0.29.2 | 0.29.2 |
consul-templateAlpine:v3.17 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.18 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.19 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.20 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.21 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.22 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.23 |
before 0.29.2-r0 | 0.29.2-r0 |
consul-templateAlpine:v3.24 |
before 0.29.2-r0 | 0.29.2-r0 |
github.com/hashicorp/consul-templateGo |
before 0.27.3, 0.28.0 up to 0.28.3, 0.29.0 up to 0.29.2 | 0.27.30.28.30.29.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-38149 is a high vulnerability (CVSS 7.5) in Hashicorp Consul Template, published August 17, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in github.com/hashicorp/consul-template 0.27.3.
References
discuss.hashicorp.com
nvd.nist.gov/vuln/detail/CVE-2022-38149
github.com/hashicorp/consul-template/commit/d6a6f4af219c28e67d847ba0e0b2bea8f5bb9076
pkg.go.dev/vuln/GO-2022-0980
security.alpinelinux.org/vuln/CVE-2022-38149