Critical
Security advisory
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-2786
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:12 UTC · Revision 1
Source evidence
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
osv:CVE-2016-2786
Complete source record
{
"id": "a42a1e5d7d11a0f671e9c0c9e44a8ced580fe8fba6cb56d00306813e1f04972c",
"url": "https://osv.dev/vulnerability/CVE-2016-2786",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-2786",
"summary": "The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.",
"evidence": "osv:CVE-2016-2786",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-2786",
"aliases": [
"CVE-2016-2786"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/puppetlabs/puppet-agent",
"type": "GIT",
"events": [
{
"introduced": "fe749a8b064afa356c145c2549df606f7cfd98c9"
},
{
"last_affected": "0780d7fd43038b45dc99dc146de1f35ef2d51944"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.0"
},
{
"last_affected": "1.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.1"
},
{
"last_affected": "1.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.2"
},
{
"last_affected": "1.3.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.4"
},
{
"last_affected": "1.3.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.5"
},
{
"last_affected": "1.3.5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"1.3.0",
"1.3.1",
"1.3.2",
"1.3.4",
"1.3.5",
"1.3.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2786.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/puppetlabs/puppetlabs-puppet_agent",
"type": "GIT",
"events": [
{
"introduced": "c6ab0483ab258a1241a66cb9d9cd5419357cbc60"
},
{
"last_affected": "fd43dc466e1f72f6c3d6d58159aadaf9b8847b68"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.0"
},
{
"last_affected": "1.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.1"
},
{
"last_affected": "1.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:puppet:puppet_agent:1.3.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.2"
},
{
"last_affected": "1.3.2"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"1.3.0",
"1.3.1",
"1.3.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2786.json"
}
}
],
"modified": "2026-10-24T10:30:50.184588445Z",
"provider": "osv",
"references": [
"https://puppet.com/security/cve/CVE-2016-2786",
"https://security.gentoo.org/glsa/201606-02"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:puppet:puppet_agent:1.3.4:*:*:*:*:*:*:*",
"cpe:2.3:a:puppet:puppet_agent:1.3.5:*:*:*:*:*:*:*"
],
"vendor_product": "puppet:puppet_agent",
"extracted_events": [
{
"range": [
{
"introduced": "1.3.4"
},
{
"last_affected": "1.3.4"
},
{
"introduced": "1.3.5"
},
{
"last_affected": "1.3.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:puppet:puppet_enterprise:2015.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:puppet:puppet_enterprise:2015.3.2:*:*:*:*:*:*:*"
],
"vendor_product": "puppet:puppet_enterprise",
"extracted_events": [
{
"range": [
{
"introduced": "2015.3.0"
},
{
"last_affected": "2015.3.0"
},
{
"introduced": "2015.3.2"
},
{
"last_affected": "2015.3.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-2786",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437170,
"published_at": "2016-06-10T15:59:01.343+00:00"
}