HashiCorp Tooling up to 0.41.x link following

Summaryinfo

A vulnerability marked as critical has been reported in HashiCorp Tooling up to 0.41.x. Affected by this issue is some unknown functionality. Performing a manipulation results in link following. This vulnerability is known as CVE-2026-5061. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in HashiCorp Tooling up to 0.41.x. This affects an unknown code. The manipulation with an unknown input leads to a link following vulnerability. CWE is classifying the issue as CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This is going to have an impact on confidentiality. The summary by CVE is:

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.

The advisory is shared at discuss.hashicorp.com. This vulnerability is uniquely identified as CVE-2026-5061 since 03/27/2026. The exploitability is told to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.42.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• HashiCorp

Name

• Tooling

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion