Skip to content
OpenAdvisories

Product · Perforce

Puppet Enterprise

6 known vulnerabilities.

Puppet Enterprise at a glance

Last 12 months
4
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 2 vulnerabilities, 2 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202622
Oct 202600
Sep 202610
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Critical 9.4
    CVE-2026-115731

    Report Deserialization Code Execution

    Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by sub…

    Perforce Puppet Enterprise puppet puppet Debian Ubuntu Azure Linux
  • Critical 9.0
    CVE-2026-115732

    Certificate Name Authorization Bypass

    Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authori…

    Perforce Puppet Enterprise puppetserver trapperkeeper-authorization-clojure Debian Ubuntu
  • High 8.6
    CVE-2026-85979

    Command Injection in Puppet Enterprise

    Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a s…

    Perforce Puppet Enterprise puppetserver Ubuntu
  • Medium 6.7
    CVE-2026-8804

    Cleartext Storage of Sensitive Information for Puppet Resource API

    Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transac…

    Perforce Puppet Enterprise Puppet Core ruby-puppet-resource-api Debian Ubuntu
  • Medium 6.9
    CVE-2025-10360

    Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

    In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterpr…

    Perforce Puppet Enterprise
  • High 8.6
    CVE-2025-5459

    OS Command Injection

    A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in vers…

    Perforce Puppet Enterprise