CVE-2026-85979
8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Perforce Software | Puppet Enterprise | 2023.8.4 <= 2023.8.10 | affected |
| Perforce Software | Puppet Enterprise | 2025.4.0 <= 2025.11.2 | affected |
| Perforce Software | Puppet Enterprise | 2023.8.11 | unaffected |
| Perforce Software | Puppet Enterprise | 2025.11.3 | unaffected |
Weaknesses
- CWE-78: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
- CWE-20: CWE-20 Improper input validation
- CWE-269: CWE-269 Improper Privilege Management
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.