CVE-2026-85979
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 11, 2026
Vendor
unknown
Description
Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.