Puppet - vulnerabilities (CVEs)

130 CVEs in 42 products, 0 in the last 30 days, newest from 2025-06-26.

Products

Puppet Enterprise - 89 CVEs
Puppet - 42 CVEs
Puppet Agent - 8 CVEs
Puppet Server - 7 CVEs
Continuous Delivery - 4 CVEs
Marionette Collective - 3 CVEs
Puppetdb - 3 CVEs
Puppetlabs-mysql - 3 CVEs
Bolt - 2 CVEs
Discovery - 2 CVEs
Facter - 2 CVEs
Mcollective - 2 CVEs
Puppet Discovery - 2 CVEs
Chloride - 1 CVEs
Cisco Ios - 1 CVEs
Cisco Ios Module - 1 CVEs
Device Manager - 1 CVEs
Firewall - 1 CVEs
Firewall Module - 1 CVEs
Hiera - 1 CVEs
Mcollective-puppet-agent - 1 CVEs
Mcollective-puppet-agent Plugin - 1 CVEs
Mcollective-sshkey-security - 1 CVEs
Pe-client-tools - 1 CVEs
Pe-razor-server - 1 CVEs
Peadm Forge Module - 1 CVEs
Puppet Connect - 1 CVEs
Puppet Dashboard - 1 CVEs
Puppet Enterprise 2018.1.x Prior To 2018.1.1 - 1 CVEs
Puppet Enterprise And Puppet Agent - 1 CVEs
Puppet Enterprise Client Tools - 1 CVEs
Puppetlabs-apache - 1 CVEs
Puppetlabs-apt - 1 CVEs
Puppetlabsapache - 1 CVEs
Puppetlabsapt - 1 CVEs
Puppetlabsfacter Task - 1 CVEs
Puppetlabsmysql - 1 CVEs
Puppetlabspuppet Conf - 1 CVEs
Razor-server - 1 CVEs
Razor-server And Pe-razor-server Prior To 1.9.0.0 - 1 CVEs
Remediate - 1 CVEs
Stdlib - 1 CVEs

Newest CVEs of Puppet

CVE-2025-5459 - CVSS 8.8 (high), 2025-06-26: A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It…
CVE-2024-9160 - CVSS 5.4 (medium), 2024-09-27: In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.
CVE-2023-5309 - CVSS 9.8 (critical), 2023-11-07: Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.
CVE-2023-5214 - CVSS 9.8 (critical), 2023-10-06: In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
CVE-2023-5255 - CVSS 7.5 (high), 2023-10-03: For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.
CVE-2023-2530 - CVSS 9.8 (critical), 2023-06-07: A privilege escalation allowing remote code execution was discovered in the orchestration service.
CVE-2023-1894 - CVSS 5.3 (medium), 2023-05-04: A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted…
CVE-2022-3276 - CVSS 8.8 (high), 2022-10-07: Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are…
CVE-2022-3275 - CVSS 9.8 (critical), 2022-10-07: Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are…
CVE-2022-2394 - CVSS 4.1 (medium), 2022-07-19: Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically,…
CVE-2022-0675 - CVSS 9.8 (critical), 2022-03-02: In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This…
CVE-2021-27025 - CVSS 6.5 (medium), 2021-11-18: A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the…
CVE-2021-27023 - CVSS 9.8 (critical), 2021-11-18: A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This…
CVE-2021-27026 - CVSS 4.4 (medium), 2021-11-18: A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged
CVE-2021-27024 - CVSS 8.1 (high), 2021-11-18: A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet…
CVE-2021-27022 - CVSS 4.9 (medium), 2021-09-07: A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they…
CVE-2021-27019 - CVSS 4.3 (medium), 2021-08-30: PuppetDB logging included potentially sensitive system information.
CVE-2021-27018 - CVSS 7.5 (high), 2021-08-30: The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to…
CVE-2021-27020 - CVSS 8.8 (high), 2021-08-30: Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
CVE-2021-27021 - CVSS 8.8 (high), 2021-07-20: A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
CVE-2020-7945 - CVSS 5.5 (medium), 2020-09-18: Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access…
CVE-2020-7944 - CVSS 7.7 (high), 2020-03-26: In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive…
CVE-2020-7943 - CVSS 7.5 (high), 2020-03-11: Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like…
CVE-2015-5686 - CVSS 8.8 (high), 2020-02-27: Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an…
CVE-2020-7942 - CVSS 6.5 (medium), 2020-02-19: Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate…
CVE-2018-11751 - CVSS 5.4 (medium), 2019-12-16: Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
CVE-2014-0175 - CVSS 9.8 (critical), 2019-12-13: mcollective has a default password set at install
CVE-2019-10694 - CVSS 9.8 (critical), 2019-12-12: The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If…
CVE-2019-10695 - CVSS 6.5 (medium), 2019-12-12: When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in…
CVE-2013-4968 - CVSS 6.1 (medium), 2019-12-11: Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct…