# puppet (RubyGems) vulnerabilities Source: https://junglewise.ai/threats/technologies/puppet Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/puppet.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in puppet (RubyGems): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2011-3871, was published on 14 May 2022. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 23 (0 critical, 0 exploited in the wild) ## About puppet (RubyGems) Ruby gem for infrastructure automation and configuration management across systems. ## Latest puppet (RubyGems) vulnerabilities - [CVE-2011-3871: Puppet uses predictable filenames, allowing arbitrary file overwrite](https://junglewise.ai/threats/cve-2011-3871-puppet-uses-predictable-filenames-allowing-arbitrary-file) (info, published 14 May 2022) - [CVE-2011-0528: Puppet does not properly restrict access to node resources](https://junglewise.ai/threats/cve-2011-0528-puppet-does-not-properly-restrict-access-to-node-resources) (info, published 14 May 2022) - [CVE-2011-3869: Puppet arbitrary file overwrite](https://junglewise.ai/threats/cve-2011-3869-puppet-arbitrary-file-overwrite) (info, published 14 May 2022) - [CVE-2011-3870: Puppet allows local users to modify the permissions of arbitrary files](https://junglewise.ai/threats/cve-2011-3870-puppet-allows-local-users-to-modify-the-permissions-of-arbitrary) (info, published 14 May 2022) - [CVE-2012-1906: Puppet uses predictable filenames, allowing arbitrary file overwrite](https://junglewise.ai/threats/cve-2012-1906-puppet-uses-predictable-filenames-allowing-arbitrary-file) (info, published 14 May 2022) - [CVE-2012-1987: Puppet Denial of Service and Arbitrary File Write](https://junglewise.ai/threats/cve-2012-1987-puppet-denial-of-service-and-arbitrary-file-write) (info, published 14 May 2022) - [CVE-2012-1988: Puppet Arbitrary Command Execution](https://junglewise.ai/threats/cve-2012-1988-puppet-arbitrary-command-execution) (info, published 14 May 2022) - [CVE-2012-1053: Puppet Privilege Escallation](https://junglewise.ai/threats/cve-2012-1053-puppet-privilege-escallation) (info, published 14 May 2022) - [CVE-2017-10689: Tarball permission preservation in puppet](https://junglewise.ai/threats/cve-2017-10689-tarball-permission-preservation-in-puppet) (low, CVSS 3, published 13 May 2022) - [CVE-2016-2785: Puppet Improper Access Control](https://junglewise.ai/threats/cve-2016-2785-puppet-improper-access-control) (low, CVSS 3.1, published 13 May 2022) - [CVE-2010-0156: Puppet arbitrary files overwrite via a symlink attack](https://junglewise.ai/threats/cve-2010-0156-puppet-arbitrary-files-overwrite-via-a-symlink-attack) (info, published 2 May 2022) - [CVE-2021-27025: Silent Configuration Failure in Puppet Agent](https://junglewise.ai/threats/cve-2021-27025-silent-configuration-failure-in-puppet-agent) (low, CVSS 3.1, published 2 Dec 2021) - [CVE-2021-27023: Unsafe HTTP Redirect in Puppet Agent and Puppet Server](https://junglewise.ai/threats/cve-2021-27023-unsafe-http-redirect-in-puppet-agent-and-puppet-server) (low, CVSS 3.1, published 2 Dec 2021) - [CVE-2020-7942: Improper Certificate Validation in Puppet](https://junglewise.ai/threats/cve-2020-7942-improper-certificate-validation-in-puppet) (low, CVSS 3.1, published 13 Apr 2021) - [CVE-2012-3408: Puppet supports use of IP addresses in certnames without warning of potential risks](https://junglewise.ai/threats/cve-2012-3408-puppet-supports-use-of-ip-addresses-in-certnames-without-warning) (info, published 24 Oct 2017) - [CVE-2012-1989: Puppet allows local users to overwrite arbitrary files via a symlink attack](https://junglewise.ai/threats/cve-2012-1989-puppet-allows-local-users-to-overwrite-arbitrary-files-via-a) (info, published 24 Oct 2017) - [CVE-2012-3865: Puppet vulnerable to Path Traversal](https://junglewise.ai/threats/cve-2012-3865-puppet-vulnerable-to-path-traversal) (info, published 24 Oct 2017) - [CVE-2012-3866: Puppet allows local users to obtain sensitive configuration information](https://junglewise.ai/threats/cve-2012-3866-puppet-allows-local-users-to-obtain-sensitive-configuration) (info, published 24 Oct 2017) - [CVE-2012-3867: Pupper does not properly restrict characters in Common Name field of Certificate Signing Request](https://junglewise.ai/threats/cve-2012-3867-pupper-does-not-properly-restrict-characters-in-common-name-field) (info, published 24 Oct 2017) - [CVE-2013-1655: Puppet Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2013-1655-puppet-improper-input-validation-vulnerability) (info, published 24 Oct 2017) - [CVE-2013-4761: Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service](https://junglewise.ai/threats/cve-2013-4761-puppet-allows-remote-attackers-to-execute-arbitrary-ruby-programs) (info, published 24 Oct 2017) - [CVE-2013-3567: Puppet Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2013-3567-puppet-improper-input-validation-vulnerability) (info, published 24 Oct 2017) - [CVE-2014-3248: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability](https://junglewise.ai/threats/cve-2014-3248-facter-hiera-mcollective-client-and-puppet-affected-by-untrusted) (info, published 24 Oct 2017) ## Most severe puppet (RubyGems) vulnerabilities - [CVE-2016-2785: Puppet Improper Access Control](https://junglewise.ai/threats/cve-2016-2785-puppet-improper-access-control) (low, CVSS 3.1, published 13 May 2022) - [CVE-2021-27023: Unsafe HTTP Redirect in Puppet Agent and Puppet Server](https://junglewise.ai/threats/cve-2021-27023-unsafe-http-redirect-in-puppet-agent-and-puppet-server) (low, CVSS 3.1, published 2 Dec 2021) - [CVE-2021-27025: Silent Configuration Failure in Puppet Agent](https://junglewise.ai/threats/cve-2021-27025-silent-configuration-failure-in-puppet-agent) (low, CVSS 3.1, published 2 Dec 2021) - [CVE-2020-7942: Improper Certificate Validation in Puppet](https://junglewise.ai/threats/cve-2020-7942-improper-certificate-validation-in-puppet) (low, CVSS 3.1, published 13 Apr 2021) - [CVE-2017-10689: Tarball permission preservation in puppet](https://junglewise.ai/threats/cve-2017-10689-tarball-permission-preservation-in-puppet) (low, CVSS 3, published 13 May 2022) - [CVE-2013-1655: Puppet Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2013-1655-puppet-improper-input-validation-vulnerability) (info, published 24 Oct 2017) - [CVE-2013-3567: Puppet Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2013-3567-puppet-improper-input-validation-vulnerability) (info, published 24 Oct 2017) - [CVE-2012-1988: Puppet Arbitrary Command Execution](https://junglewise.ai/threats/cve-2012-1988-puppet-arbitrary-command-execution) (info, published 14 May 2022) - [CVE-2012-1987: Puppet Denial of Service and Arbitrary File Write](https://junglewise.ai/threats/cve-2012-1987-puppet-denial-of-service-and-arbitrary-file-write) (info, published 14 May 2022) - [CVE-2012-3867: Pupper does not properly restrict characters in Common Name field of Certificate Signing Request](https://junglewise.ai/threats/cve-2012-3867-pupper-does-not-properly-restrict-characters-in-common-name-field) (info, published 24 Oct 2017) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other RubyGems technologies - [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack): 77 vulnerabilities - [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri): 69 vulnerabilities - [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack): 55 vulnerabilities - [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord): 26 vulnerabilities - [rubygems-update (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-update): 25 vulnerabilities - [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport): 20 vulnerabilities - [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview): 19 vulnerabilities - [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage): 19 vulnerabilities - [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms): 19 vulnerabilities - [rails-html-sanitizer (RubyGems)](https://junglewise.ai/threats/technologies/rails-html-sanitizer): 18 vulnerabilities - [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah): 17 vulnerabilities - [publify_core (RubyGems)](https://junglewise.ai/threats/technologies/publify-core): 15 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "puppet (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/puppet, 13 November 2026.