📦

puppet_enterprise

Vendor: puppet

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 1 Code Available
Total RCEs 13 Remote Access
Total CVEs 329 Total Indexed
Avg. EPSS 2.37% Exploit Prob.
Latest CVE CVE-2025-5459 Jun 26

Security Vulnerability Index

Page 1 / 33
8.6 CVSS
CVE-2025-5459
RCE

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

EPSS: 0.27%
6.8 CVSS
CVE-2023-5309

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.

EPSS: 0.29%
4.4 CVSS
CVE-2023-5255

For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

EPSS: 0.15%
9.8 CVSS
CVE-2023-2530

A privilege escalation allowing remote code execution was discovered in the orchestration service.

EPSS: 7.76%
5.3 CVSS
CVE-2023-1894

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.

EPSS: 0.06%
4.4 CVSS
CVE-2021-27026

A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged

EPSS: 0.06%
6.5 CVSS
CVE-2021-27025

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

EPSS: 0.53%
9.8 CVSS
CVE-2021-27023

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

EPSS: 0.40%
4.9 CVSS
CVE-2021-27022

A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).

EPSS: 0.33%
8.8 CVSS
CVE-2021-27020

Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.

EPSS: 0.49%