---
title: "Puppet vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/puppet
type: vendor
description: "Puppet has 132 published CVEs, 0 in CISA KEV and 7 with public exploits."
updated: 2025-06-26
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Puppet vulnerabilities

- **Published CVEs:** 132
- **In CISA KEV:** 0
- **With a public exploit:** 7
- **With a patch:** 95
- **Average CVSS:** 6.4
- **CVEs in the last two years:** 1
- **First CVE:** 2010-03-03
- **Latest CVE:** 2025-06-26

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 19 |
| High | 30 |
| Medium | 69 |
| Low | 14 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [Puppet Enterprise](https://radicalnotion.ai/vendor/puppet/puppet-enterprise) | 90 |
| [Puppet](https://radicalnotion.ai/vendor/puppet/puppet) | 49 |
| [Puppet Agent](https://radicalnotion.ai/vendor/puppet/puppet-agent) | 12 |
| [Puppet server](https://radicalnotion.ai/vendor/puppet/puppet-server) | 8 |
| [puppet-agent](https://radicalnotion.ai/vendor/puppet/puppet-agent) | 6 |
| [puppet enterprise users](https://radicalnotion.ai/vendor/puppet/puppet-enterprise-users) | 5 |
| [puppetserver](https://radicalnotion.ai/vendor/puppet/puppetserver) | 5 |
| [continuous delivery](https://radicalnotion.ai/vendor/puppet/continuous-delivery) | 4 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-264](https://radicalnotion.ai/cwe/cwe-264) | Permissions, Privileges, and Access Controls | 14 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 12 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 11 |
| [CWE-295](https://radicalnotion.ai/cwe/cwe-295) | Improper Certificate Validation | 9 |
| [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 7 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5 |
| [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 4 |
| [CWE-522](https://radicalnotion.ai/cwe/cwe-522) | Insufficiently Protected Credentials | 4 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [mitre](https://radicalnotion.ai/cna/mitre) | 70 |
| [puppet](https://radicalnotion.ai/cna/puppet) | 52 |
| [redhat](https://radicalnotion.ai/cna/redhat) | 6 |
| [Perforce](https://radicalnotion.ai/cna/perforce) | 4 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2018 | 18 |
| 2019 | 8 |
| 2020 | 5 |
| 2021 | 9 |
| 2022 | 4 |
| 2023 | 5 |
| 2024 | 1 |
| 2025 | 1 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2025-5459 | OS Command Injection | high | 8.6 | 1.1% | No | 2025-06-26 |
| CVE-2024-9160 | Security Misconfiguration in Forge module PEADM | medium | 5.4 | 0.2% | No | 2024-09-27 |
| CVE-2023-5309 | Broken Session Management in Puppet Enterprise | critical | 9.8 | 0.6% | No | 2023-11-07 |
| CVE-2023-5214 | CVE-2023-5214 - Privilege Escalation in Puppet Bolt | critical | 9.8 | 0.4% | No | 2023-10-06 |
| CVE-2023-5255 | Denial of Service for Revocation of Auto Renewed Certificates | high | 7.5 | 0.5% | No | 2023-10-03 |
| CVE-2023-2530 | - | critical | 9.8 | 1.1% | No | 2023-06-07 |
| CVE-2023-1894 | - | medium | 5.3 | 0.4% | No | 2023-05-04 |
| CVE-2022-3275 | Puppetlabs-apt Command Injection | critical | 9.8 | 2.4% | No | 2022-10-07 |
| CVE-2022-3276 | Puppetlabs-mysql Command Injection | high | 8.8 | 1.7% | No | 2022-10-07 |
| CVE-2022-2394 | Sensitive Parameter Exposure in Puppet Bolt prior to 3.24 | medium | 4.1 | 0.5% | No | 2022-07-19 |
| CVE-2022-0675 | Puppet Firewall Module May Leave Unmanaged Rules | critical | 9.8 | 0.9% | No | 2022-03-02 |
| CVE-2021-27023 | Unsafe HTTP Redirect in Puppet Agent and Puppet Server | critical | 9.8 | 1.4% | No | 2021-11-18 |

## Frequently asked questions

### How many CVEs does Puppet have?

Puppet has 132 published CVE records since 2010, including 1 in the last two years.

### How many Puppet CVEs are in CISA KEV?

None of Puppet's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which Puppet products have the most CVEs?

The Puppet products with the most published CVEs are Puppet Enterprise, Puppet, Puppet Agent, Puppet server, puppet-agent.

### What are the most common weakness types in Puppet CVEs?

Puppet's CVEs most often map to these CWE weakness types: CWE-264 (Permissions, Privileges, and Access Controls), CWE-20 (Improper Input Validation), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-295 (Improper Certificate Validation).

### Are there public exploits for Puppet vulnerabilities?

Yes — 7 of Puppet's CVEs have a known public exploit.

### How many critical Puppet vulnerabilities are there?

Puppet has 19 critical and 30 high-severity CVEs.

### What is the average severity of Puppet CVEs?

The average CVSS base score across Puppet's scored CVEs is 6.4.

## Related vendors

- [Motorola](https://radicalnotion.ai/vendor/motorola) (134 CVEs)
- [Checkmk](https://radicalnotion.ai/vendor/checkmk) (134 CVEs)
- [Codepeople](https://radicalnotion.ai/vendor/codepeople) (134 CVEs)
- [Automattic](https://radicalnotion.ai/vendor/automattic) (133 CVEs)
- [Honeywell](https://radicalnotion.ai/vendor/honeywell) (133 CVEs)
- [RealMag777](https://radicalnotion.ai/vendor/realmag777) (132 CVEs)
- [Grokability](https://radicalnotion.ai/vendor/grokability) (131 CVEs)
- [PowerDNS](https://radicalnotion.ai/vendor/powerdns) (131 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/puppet). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.