PT-2025-39287 · Puppet · Puppet Enterprise

Published 2025-09-24 · Updated 2025-09-24 · CVE-2025-10360

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2025.4.0 through 2025.5

Description The encryption key for the Infra Assistant database was not excluded from Puppet backups in Puppet Enterprise. This key is only present if a Puppet Enterprise Advanced license is active and the Infra Assistant feature is enabled. The key encrypts the API key for the AI provider account within the Infra Assistant database.

Recommendations Update to Puppet Enterprise version 2025.6. Follow the remediation steps in the release notes for Puppet Enterprise version 2025.6 if updating is not immediately possible.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-10360

Affected Products

Puppet Enterprise

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10360 · Security Note
• https://twitter.com/VulmonFeeds/status/1971000142242230678 · Twitter Post
• https://portal.perforce.com/s/cve/a91PA000001Smp7YAC/insufficiently-protected-credentials-in-puppet-enterprise-20254-and-20255 · Note
• https://t.me/cveNotify/136298 · Telegram Post
• https://twitter.com/CVEnew/status/1970892727131803954 · Twitter Post