What is CVE-2021-27023?

CVE-2021-27023 is a critical-severity vulnerability in Puppet Agent. CVSS score: 9.8/10. Published 2021-11-18.

How severe is CVE-2021-27023?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Puppet Agent

CVE-2021-27023

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Published 2021-11-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.014 (71.5th percentile), scored 2026-10-20.

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 71.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000

Affected products

Puppet Agent
Puppet Enterprise
Puppet Server
Fedoraproject Fedora — versions 35
Puppet Enterprise, Server, Agent — versions Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1

References

puppet.com/security/cve/CVE-2021-27023 (Vendor Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)

Frequently asked questions

What is CVE-2021-27023?: CVE-2021-27023 is a critical-severity vulnerability in Puppet Agent. CVSS score: 9.8/10. Published 2021-11-18.
How severe is CVE-2021-27023?: Critical severity. CVSS v3 base score is 9.8 out of 10.