CVE-2021-27024: Puppet Continuous Delivery

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0

Affected products

• Puppet Continuous Delivery: before 4.10.0 (fixed in 4.10.0)

Published 2021-11-18. Last modified 2026-06-17.