CVE-2015-1426: Puppet Facter

Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.

Affected products

• Puppet Facter: version 1.6.0 only; version 1.6.1 only; version 1.6.2 only; version 1.6.3 only; version 1.6.4 only; version 1.6.5 only; …
• Puppetlabs Facter: version 1.6.1 only; version 1.6.2 only; version 1.6.3 only; version 1.6.4 only; version 1.6.5 only; version 1.6.6 only; …

Published 2015-02-23. Last modified 2026-06-17.