CVE-2017-2290: Puppet Mcollective-Puppet-Agent

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.

Affected products

• Puppet Mcollective-Puppet-Agent: version 1.12.0 only

Published 2017-03-03. Last modified 2026-06-17.