---
id: CVE-2025-5459
title: >-
  A user with specific node group editing permissions and a specially crafted
  class parameter could be used to execute commands as root on the primary host
summary: >-
  A user with specific node group editing permissions and a specially crafted
  class parameter could be used to execute commands as root on the primary host.
  It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and
  has…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: puppet
product: puppet_enterprise
affected:
  - 'puppet_enterprise >= 2018.1.8, < 2023.8.4'
  - puppet_enterprise = 2025.3.0
patched:
  - puppet_enterprise 2023.8.4
published: '2025-06-26'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5459'
references:
  - url: 'https://portal.perforce.com/s/detail/a91PA000001SiDdYAK'
    label: security@puppet.com
  - url: 'http://seclists.org/fulldisclosure/2026/Sep/9'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00491
epssPercentile: 0.41294
ingestedAt: '2026-09-04T03:12:59.646Z'
---

## Overview

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

## Affected

- `puppet_enterprise >= 2018.1.8, < 2023.8.4`
- `puppet_enterprise = 2025.3.0`

## Remediation

Upgrade past the affected range:

- `puppet_enterprise 2023.8.4`