{"id":"CVE-2022-38149","details":"HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.","aliases":["GHSA-8449-7gc2-pwrp","GO-2022-0980"],"modified":"2026-08-12T03:51:15.746405738Z","published":"2022-08-17T14:30:53Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38149.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://discuss.hashicorp.com"},{"type":"WEB","url":"https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38149.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38149"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hashicorp/consul-template","events":[{"introduced":"0"},{"fixed":"06389a3d3c6fc772f8c25903a4bd985a0c8141f0"}],"database_specific":{"cpe":"cpe:2.3:a:hashicorp:consul_template:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.29.2"}],"source":"CPE_RANGE"}}],"versions":["v0.27.2","v0.29.1","v0.29.0","v0.28.0","v0.27.1","v0.27.0","v0.26.0","v0.25.2","v0.25.1","v0.25.0","v0.24.1","v0.24.0","v0.23.0","v0.22.1","v0.22.0","v0.21.3","v0.21.2","v0.21.1","v0.21.0","v0.20.1","v0.20.0","v0.19.5","v0.19.4","v0.19.3","v0.19.2","v0.19.1","v0.19.0","v0.18.5","v0.18.4","v0.18.3","v0.18.2","v0.18.1","v0.18.0","v0.18.0-rc3","v0.18.0-rc1","v0.16.0","v0.16.0-rc1","v0.15.0","v0.14.0","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.1","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.0","v0.6.5","v0.6.1","v0.6.0","v0.5.1","v0.5.0","v0.4.0","v0.3.1","v0.3.0","v0.2.0","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38149.json"}}],"schema_version":"1.9.0"}