CVE-2019-10694

9.8 criticalEPSS 1.1%

Critical (9.8) in puppet puppet enterprise. EPSS 1.1% chance of exploitation in the next 30 days.

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2019-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet_enterprise

References

https://puppet.com/security/cve/CVE-2019-10694
https://puppet.com/security/cve/CVE-2019-10694

Check your stack JSON