CVE-2016-5714

7.2 highEPSS 2.2%

High (7.2) in puppet. EPSS 2.2% chance of exploitation in the next 30 days.

Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2017-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet_agent
puppet:puppet_enterprise

References

https://bugs.gentoo.org/597684
https://puppet.com/security/cve/cve-2016-5714
https://puppet.com/security/cve/pxp-agent-oct-2016
https://security.gentoo.org/glsa/201710-12
https://bugs.gentoo.org/597684

Check your stack JSON