{"id":"CVE-2022-38149","aliases":["ALPINE-CVE-2022-38149","EUVD-2022-6511","GHSA-8449-7gc2-pwrp","GO-2022-0980"],"status":"published","title":"HashiCorp Consul Template could reveal Vault secret contents in error messages","description":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00874,"percentile":0.5921,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2022-08-17T14:30:53Z","modified":"2026-11-03T07:30:39Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/consul-template","fixed_in":["0.27.3","0.28.3","0.29.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.17","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"consul-template","fixed_in":["0.29.2-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.28.0"},{"fixed":"0.28.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.29.0"},{"fixed":"0.29.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"consul-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.2-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"SEMVER","events":[{"introduced":"0.28.0"},{"fixed":"0.28.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"SEMVER","events":[{"introduced":"0.29.0"},{"fixed":"0.29.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul-template","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.3"},{"introduced":"0.28.0"},{"fixed":"0.28.3"},{"introduced":"0.29.0"},{"fixed":"0.29.2"}]}]}],"products":[{"vendor":"hashicorp","product":"consul_template"}],"references":[{"url":"https://discuss.hashicorp.com","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38149","tags":["advisory"]},{"url":"https://github.com/hashicorp/consul-template/commit/d6a6f4af219c28e67d847ba0e0b2bea8f5bb9076","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0980","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8449-7gc2-pwrp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-38149","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38149.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/consul","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-38149","description":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","status":"published","published":"2022-08-17T14:30:53Z","modified":"2024-08-03T10:45:52.674Z","updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-6511","description":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","status":"published","published":"2022-08-17T14:30:53Z","modified":"2024-08-03T10:45:52Z","updated_at":"2026-11-03T03:25:22.392967Z"}],"ghsa":[{"id":"GHSA-8449-7gc2-pwrp","title":"HashiCorp Consul Template could reveal Vault secret contents in error messages","description":"In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the `*template.Template.Execute 5` method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.","status":"published","published":"2022-08-18T00:00:17Z","modified":"2024-05-20T21:32:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2022-38149","description":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","status":"published","published":"2022-08-17T15:15:08.607Z","modified":"2026-06-17T04:56:11.863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"ALPINE-CVE-2022-38149","description":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","status":"published","published":"2022-08-17T15:15:08.607Z","modified":"2026-11-03T07:30:39.800722465Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"GHSA-8449-7gc2-pwrp","title":"HashiCorp Consul Template could reveal Vault secret contents in error messages","description":"In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the `*template.Template.Execute 5` method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.","status":"published","published":"2022-08-18T00:00:17Z","modified":"2024-05-20T21:32:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"CVE-2022-38149","description":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","status":"published","published":"2022-08-17T14:30:53Z","modified":"2026-10-28T02:30:32.39984723Z","updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GO-2022-0980","title":"Exposure of Vault secrets via error messages in github.com/hashicorp/consul-template","description":"The text of errors returned by Template.Execute can contain Vault secrets, potentially revealing these secrets in logs or error reports.","status":"published","published":"2022-09-21T15:10:27Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}