CVE-2026-5061: Hashicorp Tooling

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.

Affected products

• Hashicorp Tooling: from 0.1.0, before 0.42.0 (fixed in 0.42.0)

Published 2026-05-12. Last modified 2026-06-17.