CVE-2021-27022: Puppet

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).

Affected products

• Puppet Puppet: from 2021.0.0, before 2021.3.0 (fixed in 2021.3.0)
• Puppet Puppet Enterprise: before 2019.8.8 (fixed in 2019.8.8)

Published 2021-09-07. Last modified 2026-06-17.