CVE-2016-5714

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-18 · updated 2026-06-17
Weakness: CWE-284

Description

Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."

Affected products

Puppet Agent: from 1.3.6 through 1.7.0
Puppet Enterprise: 2015.3.3, 2016.1.1, 2016.1.2, 2016.2.0, 2016.2.1

References

https://bugs.gentoo.org/597684
https://puppet.com/security/cve/cve-2016-5714
https://puppet.com/security/cve/pxp-agent-oct-2016
https://security.gentoo.org/glsa/201710-12
https://bugs.gentoo.org/597684
https://puppet.com/security/cve/cve-2016-5714
https://puppet.com/security/cve/pxp-agent-oct-2016
https://security.gentoo.org/glsa/201710-12

Get alerted when CVE-2016-5714 or the next vulnerability affects your stack