1. Home
  2. CVE Database
  3. CVE-2025-5459
HIGH · 8.8

CVE-2025-5459

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1....

Vulnerability Description

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
PuppetPuppet Enterprise>= 2018.1.8, < 2023.8.4

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2025-5459?

CVE-2025-5459 is a vulnerability with a CVSS score of 8.8 (HIGH). A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1....

How severe is CVE-2025-5459?

CVE-2025-5459 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-5459?

Check the references section above for vendor advisories and patch information. Affected products include: Puppet Puppet Enterprise.