Read the docs
TI-2022-17853 Aliases CVE-2022-38149GHSA-8449-7gc2-pwrp

HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of…

Priority LOW 34CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.

Why it matters now

EPSS 0.00874 59th percentileScored 2026-11-07
Fix Partial github.com/hashicorp/consul-template (Go): 0.27.3, 0.28.3, 0.29.2Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/consul-template (Go)before 0.27.30.27.3Patch availableGHSA-8449-7gc2-pwrp
—github.com/hashicorp/consul-template (Go)0.28.0 to before 0.28.30.28.3Patch availableGHSA-8449-7gc2-pwrp
—github.com/hashicorp/consul-template (Go)0.29.0 to before 0.29.20.29.2Patch availableGHSA-8449-7gc2-pwrp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/consul-template (Go) Vendor— Affected before 0.27.3 Fixed in 0.27.3 Patch available GHSA-8449-7gc2-pwrp
  • github.com/hashicorp/consul-template (Go) Vendor— Affected 0.28.0 to before 0.28.3 Fixed in 0.28.3 Patch available GHSA-8449-7gc2-pwrp
  • github.com/hashicorp/consul-template (Go) Vendor— Affected 0.29.0 to before 0.29.2 Fixed in 0.29.2 Patch available GHSA-8449-7gc2-pwrp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:consul_template:*:*:*:*:*:*:*:*before 0.29.2VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:consul_template:*:*:*:*:*:*:*:* Versions before 0.29.2 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-8449-7gc2-pwrp github.com/hashicorp/consul-template (Go) Fixed in 0.27.3 Advisory →
  • Fix · GHSA-8449-7gc2-pwrp github.com/hashicorp/consul-template (Go) Fixed in 0.28.3 Advisory →
  • Fix · GHSA-8449-7gc2-pwrp github.com/hashicorp/consul-template (Go) Fixed in 0.29.2 Advisory →

Red Hat 1 advisory

  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
Not affected: 3 products
  • RHODF 4.13 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38149
  2. 2026-10-03 Alias added: GHSA-8449-7gc2-pwrp

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences