Executive brief
Northern.tech CFEngine is a configuration management tool used to automate the setup and maintenance of large-scale IT infrastructure. A vulnerability in the CFEngine policy language could allow an attacker with limited access to bypass security restrictions and execute unauthorized commands on managed systems. This could lead to a full system takeover if the software is configured to process data from untrusted external sources.
Technical details
A command injection vulnerability exists in the CFEngine policy language due to insufficient input sanitization when processing external data. While CFEngine is designed to execute commands via specific 'promise' types, this flaw allows shell commands to be injected into resource types where they are not expected, such as those managing users or packages. The vulnerability is not exploitable in default configurations; it requires a custom policy that processes data from an external source (e.g., a CMDB or API) without proper escaping. An attacker who can influence this external data can achieve arbitrary code execution on the CFEngine hub or managed hosts. The issue is resolved in versions 3.21.8, 3.24.3, and 3.27.0.
Affected products
- Northern.tech CFEngine Enterprise Before 3.21.8, 3.24.3, 3.27.0
- Northern.tech CFEngine Community Before 3.21.8, 3.24.3, 3.27.0
Timeline
- 2026-02-09: disclosed: Vendor blog post published detailing the vulnerability
- 2026-05-14: advisory: CVE published to NVD