CVE-2026-85979 Overview
CVE-2026-85979 is a command injection vulnerability in Puppet Enterprise that allows an authenticated administrator to execute arbitrary shell commands as root. The flaw exists in a parameter that is passed to a shell execution context without sufficient sanitization. Successful exploitation results in full compromise of the affected system.
The issue is tracked as an input validation weakness [CWE-20] and affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2. Perforce resolved the issue in Puppet Enterprise 2023.8.11 and 2025.11.3.
Critical Impact
An authenticated user with Puppet administrative privileges can inject shell commands that execute with root privileges, leading to full host compromise.
Affected Products
- Puppet Enterprise 2023.8.0 through 2023.8.10
- Puppet Enterprise 2025.0.0 through 2025.11.2
- Fixed versions: Puppet Enterprise 2023.8.11 and 2025.11.3
Discovery Timeline
- 2026-09-11 - CVE-2026-85979 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-85979
Vulnerability Analysis
Puppet Enterprise accepts a user-supplied parameter and forwards it to a shell execution context. The application does not adequately sanitize or validate the value before it reaches the shell interpreter. An authenticated administrator can supply shell metacharacters within this parameter to break out of the intended command and append arbitrary operating system commands.
Because the Puppet Enterprise service that invokes the shell runs as root, injected commands inherit root privileges. This provides an authenticated attacker with a straightforward path from administrative access to full operating system control on the primary Puppet server. Compromise of a Puppet primary is significant because the host manages configuration for every node in the fleet.
Root Cause
The underlying weakness is improper input validation [CWE-20]. The affected parameter is concatenated into a shell command string rather than passed through a parameterized API or escaped for the target interpreter. Any shell control character supplied by the caller is interpreted verbatim by the shell.
Attack Vector
Exploitation requires network access to the Puppet Enterprise console or API and valid Puppet administrative credentials. An attacker who has phished, brute-forced, or otherwise obtained administrator credentials submits a crafted value for the vulnerable parameter. The Puppet Enterprise backend executes the injected shell payload as root. Refer to the Perforce Security Advisory for vendor-specific technical detail.
// No verified proof-of-concept is publicly available.
// See the Perforce Security Advisory for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-85979
Indicators of Compromise
- Unexpected child processes spawned by Puppet Enterprise service accounts, particularly shells (/bin/sh, /bin/bash) or interpreters (python, perl, ruby) running as root.
- Outbound network connections initiated from the Puppet primary to unfamiliar hosts shortly after administrator API calls.
- New cron jobs, systemd units, SSH authorized keys, or local accounts appearing on the Puppet primary without change-control tickets.
Detection Strategies
- Baseline the process tree of the Puppet Enterprise services and alert on deviations, especially execution of shell utilities or download tools such as curl or wget.
- Correlate Puppet Enterprise audit logs of administrative API calls with host-level process execution telemetry to surface parameter values containing shell metacharacters (;, |, &, backticks, $()).
- Review authentication logs for suspicious Puppet administrator sessions, including logins from new source IPs or outside change windows.
Monitoring Recommendations
- Forward Puppet Enterprise application, audit, and operating system logs to a centralized analytics platform for retention and correlation.
- Monitor file integrity on /etc, Puppet configuration directories, and web application code paths on the primary server.
- Alert on any privilege-changing command executed by the Puppet service user, such as chmod, chown, useradd, or passwd.
How to Mitigate CVE-2026-85979
Immediate Actions Required
- Upgrade Puppet Enterprise to 2023.8.11 or 2025.11.3 as published in the Perforce Security Advisory.
- Rotate credentials for all Puppet administrative accounts and any secrets stored on the primary server following the upgrade.
- Audit recent administrative activity and process execution on Puppet primaries for signs of prior exploitation.
Patch Information
Perforce resolved CVE-2026-85979 in Puppet Enterprise 2023.8.11 and 2025.11.3. Administrators should schedule an emergency maintenance window to apply the fixed release. Full remediation details are available in the Perforce Security Advisory.
Workarounds
- Restrict network access to the Puppet Enterprise console and API to trusted management networks and jump hosts until patching is complete.
- Enforce multi-factor authentication for all Puppet administrative accounts to reduce the likelihood of credential-based abuse.
- Apply the principle of least privilege by removing Puppet administrative rights from accounts that do not require them.
# Verify the installed Puppet Enterprise version prior to and after patching
/opt/puppetlabs/bin/puppet --version
cat /opt/puppetlabs/server/pe_version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
