Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which…
Priority LOW 28CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264.
Summary
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
Why it matters now
EPSS 0.01652 76th percentileScored 2026-11-07
Fix Fixed puppet (RubyGems): 2.6.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | puppet (RubyGems) | 2.6.0 to before 2.6.4 | 2.6.4 | Patch available | GHSA-9pvx-fwwh-w289 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- puppet (RubyGems) Vendor— Affected 2.6.0 to before 2.6.4 Fixed in 2.6.4 Patch available GHSA-9pvx-fwwh-w289
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | Puppet |
| cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:* | 2.6.1 | Vulnerable | Puppet |
| cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Puppet |
| cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:* | 2.6.3 | Vulnerable | Puppet |
- cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Puppet
- cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Puppet
- cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Puppet
- cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Puppet
Remediation
- Fix · GHSA-9pvx-fwwh-w289 puppet (RubyGems) Fixed in 2.6.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2011-0528
- 2026-10-03 Alias added: GHSA-9pvx-fwwh-w289
References
Other 7
- [oss-security] 20110127 CVE request: puppet
- [puppet-users] 20101201 SECURITY: Authorization vulnerability in Puppet 2.6.x
- [oss-security] 20110127 Re: CVE request: puppet
- https://github.com/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3
- https://github.com/puppetlabs/puppet
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-0528.yml
- http://www.mail-archive.com/[email protected]/msg16429.html
More Puppet vulnerabilities
- TI-2016-02327 Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet… CVSS 3.1CRITICAL 9.8
- TI-2013-01442 The (1) template and (2) inline_template functions in the master server in Puppet before… CVSS 2.0HIGH 9.0
- TI-2021-08594 SQL injection in Puppet DB CVSS 3.1HIGH 8.8
- TI-2017-01576 Deserialization of untrusted data in Puppet server CVSS 3.0HIGH 8.2
- TI-2018-04793 Untrusted search path in Puppet Enterprise and Puppet Agent CVSS 3.0HIGH 8.8
- TI-2013-01456 Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later… CVSS 2.0HIGH 7.5
Sources
- CVE-2011-0528 · CVE Program
- CVE-2011-0528 · NVD
- FIRST EPSS
- GHSA-9pvx-fwwh-w289 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences