EUVD-2026-76124
GHSA-j9jp-p256-9294
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no complexity; PR:H for Puppet admin requirement; S:C because injected commands escape the application and execute as OS root.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.
AnalysisAI
Command injection in Puppet Enterprise's java_keystore_passwd parameter handling allows authenticated Puppet administrators to execute arbitrary OS commands with root privileges. The parameter value is passed to a shell execution context without sanitization, enabling full system compromise from a high-trust but network-accessible role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user holding Puppet administrative privileges within Puppet Enterprise - this is a high-trust role (CVSS PR:H), not a standard user account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 with PR:H accurately reflects that only authenticated Puppet administrators can trigger this flaw, which substantially limits the exposed attack surface compared to unauthenticated vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Perforce vendor advisory at https://portal.perforce.com/s/cve/a91Qi000003CybNIAS/command-injection-in-puppet-enterprise and apply the available patch; the exact fixed version is not independently confirmed from the data provided and must be verified there. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Puppet Enterprise deployments and inventory current administrators with access; restrict Puppet admin role assignment to essential personnel only; audit existing Puppet admin accounts for legitimacy and business justification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Puppet Enterprise
View allNginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. Rated h
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attacker
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Fa
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary cod
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not prope
Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for
A privilege escalation allowing remote code execution was discovered in the orchestration service. Rated critical severi
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTT
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the ins
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext t
The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today