CVE-2016-2785: Puppet

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

Affected products

• Puppet Puppet: version 4.0.0 only; version 4.1.0 only; version 4.2.0 only; version 4.2.1 only; version 4.2.2 only; version 4.2.3 only; …
• Puppet Puppet Agent: version 1.4.1 only
• Puppet Puppet Server: version 2.0.0 only; version 2.1.0 only; version 2.1.1 only; version 2.1.2 only; version 2.2.0 only; version 2.3.0 only; …

Published 2016-06-10. Last modified 2026-06-17.