Puppet
110 CVEs across 45 Puppet products. Browse Puppet vulnerabilities, severities, and proof-of-concept exploits.
Puppet products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5459 | High | 8.8 | 2025-06-26 | A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It a… |
CVE-2024-9160 | | 2024-09-27 | In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered. | |
CVE-2023-5309 | Medium | 6.8 | 2023-11-07 | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. |
CVE-2023-5214 | Medium | 6.5 | 2023-10-06 | In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified. |
CVE-2023-5255 | Medium | 4.4 | 2023-10-03 | For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. |
CVE-2023-2530 | Critical | 9.8 | 2023-06-07 | A privilege escalation allowing remote code execution was discovered in the orchestration service. |
CVE-2023-1894 | Medium | 5.3 | 2023-05-04 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted cer… |
CVE-2022-3276 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are… |
CVE-2022-3275 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are abl… |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |
CVE-2022-0675 | Medium | 5.6 | 2022-03-02 | In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This… |
CVE-2021-27026 | Medium | 4.4 | 2021-11-18 | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged |
CVE-2021-27025 | Medium | 6.5 | 2021-11-18 | A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the fi… |
CVE-2021-27024 | High | 8.1 | 2021-11-18 | A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterpris… |
CVE-2021-27023 | Critical | 9.8 | 2021-11-18 | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This i… |
CVE-2021-27022 | Medium | 4.9 | 2021-09-07 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should… |
CVE-2021-27020 | High | 8.8 | 2021-08-30 | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. |
CVE-2021-27019 | Medium | 4.3 | 2021-08-30 | PuppetDB logging included potentially sensitive system information. |
CVE-2021-27018 | High | 7.5 | 2021-08-30 | The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to… |
CVE-2021-27021 | High | 8.8 | 2021-07-20 | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query. |
CVE-2020-7945 | Medium | 5.5 | 2020-09-18 | Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access… |
CVE-2020-7944 | High | 7.7 | 2020-03-26 | In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive… |
CVE-2020-7943 | High | 7.5 | 2020-03-11 | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like host… |
CVE-2015-5686 | High | 8.8 | 2020-02-27 | Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an atta… |
CVE-2020-7942 | Medium | 6.5 | 2020-02-19 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate al… |
CVE-2018-11751 | Medium | 5.4 | 2019-12-16 | Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
CVE-2014-0175 | Critical | 9.8 | 2019-12-13 | mcollective has a default password set at install |
CVE-2019-10695 | Medium | 6.5 | 2019-12-12 | When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the… |
CVE-2019-10694 | Critical | 9.8 | 2019-12-12 | The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they… |
CVE-2013-4968 | Medium | 6.1 | 2019-12-11 | Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cros… |
CVE-2015-1855 | Medium | 5.9 | 2019-11-29 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate… |
CVE-2018-6517 | High | 7.5 | 2019-03-21 | Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file witho… |
CVE-2018-11747 | Critical | 9.8 | 2019-03-21 | Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be genera… |
CVE-2018-11752 | Medium | 5.5 | 2018-10-02 | Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run. These… |
CVE-2018-11750 | Medium | 6.5 | 2018-10-02 | Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, hos… |
CVE-2018-11748 | High | 7.8 | 2018-10-02 | Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved… |
CVE-2018-11749 | Critical | 9.8 | 2018-08-24 | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet… |
CVE-2018-11746 | High | 8.6 | 2018-07-03 | In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if… |
CVE-2018-6516 | High | 7.8 | 2018-06-14 | On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3… |
CVE-2018-6515 | High | 7.8 | 2018-06-11 | Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted config… |
CVE-2018-6514 | High | 7.8 | 2018-06-11 | In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preload… |
CVE-2018-6513 | High | 8.8 | 2018-06-11 | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x… |
CVE-2018-6512 | Critical | 9.8 | 2018-06-11 | The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise… |
CVE-2018-6511 | Medium | 5.4 | 2018-05-08 | A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when… |
CVE-2018-6510 | Medium | 5.4 | 2018-05-08 | A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when… |
CVE-2018-6508 | High | 8.0 | 2018-02-09 | Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet… |
CVE-2017-10690 | Medium | 6.5 | 2018-02-09 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was… |
CVE-2017-10689 | Medium | 5.5 | 2018-02-09 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this… |
CVE-2017-2297 | High | 7.5 | 2018-02-01 | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been… |
CVE-2017-2296 | Medium | 6.5 | 2018-02-01 | In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role di… |
CVE-2017-2293 | Medium | 4.9 | 2018-02-01 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbi… |
CVE-2015-7224 | Critical | 9.8 | 2017-12-21 | puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'my… |
CVE-2015-4100 | Medium | 6.8 | 2017-12-21 | Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted… |
CVE-2015-8470 | Medium | 6.5 | 2017-12-11 | The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier f… |
CVE-2015-6502 | Medium | 6.1 | 2017-12-11 | Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2014-3250 | Medium | 6.5 | 2017-12-11 | The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain s… |
CVE-2016-5713 | Critical | 9.8 | 2017-12-06 | Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet run… |
CVE-2016-5714 | High | 7.2 | 2017-10-18 | Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechan… |
CVE-2017-2299 | High | 7.5 | 2017-09-15 | Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parame… |
CVE-2016-5716 | High | 8.8 | 2017-08-09 | The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the cons… |
CVE-2017-7529 | High | 7.5 | 2017-07-13 | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of pote… |
CVE-2017-2295 | High | 8.2 | 2017-07-05 | Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could… |
CVE-2017-2294 | High | 7.5 | 2017-07-05 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key… |
CVE-2017-2298 | Medium | 6.5 | 2017-06-30 | The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised serv… |
CVE-2017-2292 | Critical | 9.0 | 2017-06-30 | Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the ser… |
CVE-2017-2290 | High | 8.8 | 2017-03-03 | On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with a… |
CVE-2016-2788 | Critical | 9.8 | 2017-02-13 | MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping c… |
CVE-2016-2787 | Medium | 5.3 | 2017-02-13 | The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remo… |
CVE-2016-9686 | Medium | 5.3 | 2017-02-08 | The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing comm… |
CVE-2016-5715 | Medium | 6.1 | 2017-01-12 | Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web si… |
CVE-2015-6501 | Medium | 6.1 | 2017-01-12 | Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct ph… |
CVE-2016-2786 | Critical | 9.8 | 2016-06-10 | The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which… |
CVE-2016-2785 | Critical | 9.8 | 2016-06-10 | Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended au… |
CVE-2015-7330 | High | 8.8 | 2016-04-11 | Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protoc… |
CVE-2015-7328 | Medium | 4.7 | 2016-01-08 | Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certificat… |
CVE-2015-1426 | | 2015-02-23 | Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node. | |
CVE-2015-1029 | | 2015-01-16 | The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privil… | |
CVE-2014-9355 | | 2014-12-19 | Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an uns… | |
CVE-2014-7170 | | 2014-12-17 | Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the sta… | |
CVE-2014-3248 | | 2014-11-16 | Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera… | |
CVE-2014-3251 | | 2014-08-12 | The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates… | |
CVE-2014-3249 | | 2014-06-17 | Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. | |
CVE-2013-4963 | | 2014-03-14 | Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users… | |
CVE-2013-1399 | | 2014-03-14 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in t… | |
CVE-2013-1398 | | 2014-03-14 | The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authen… | |
CVE-2012-5158 | | 2014-03-14 | Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retai… | |
CVE-2012-0891 | | 2014-03-14 | Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote atta… | |
CVE-2013-4971 | | 2014-03-09 | Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive informatio… | |
CVE-2013-4966 | | 2014-03-09 | The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to cre… | |
CVE-2011-0528 | | 2014-02-17 | Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources… | |
CVE-2013-4969 | | 2014-01-07 | Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a sym… | |
CVE-2013-4965 | | 2013-10-25 | Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attacker… | |
CVE-2013-4957 | | 2013-10-25 | The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type. | |
CVE-2013-4967 | | 2013-08-20 | Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console paramete… | |
CVE-2013-4964 | | 2013-08-20 | Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture t… | |
CVE-2013-4962 | | 2013-08-20 | The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leve… | |
CVE-2013-4961 | | 2013-08-20 | Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote att… | |
CVE-2013-4959 | | 2013-08-20 | Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain s… | |
CVE-2013-4958 | | 2013-08-20 | Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation. | |
CVE-2013-4956 | | 2013-08-20 | Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, instal… |