CVE-2025-10360

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version.

CVSS

No CVSS.

References

Link	Resource
https://portal.perforce.com/s/cve/a91PA000001Smp7YAC/insufficiently-protected-credentials-in-puppet-enterprise-20254-and-20255

Configurations

No configuration.

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) En las versiones 2025.4.0 y 2025.5 de Puppet Enterprise, la clave de cifrado utilizada para cifrar contenido en la base de datos de Infra Assistant no fue excluida de los archivos recopilados por la copia de seguridad de Puppet. La clave solo está presente en el sistema si el usuario tiene una licencia Puppet Enterprise Advanced y ha habilitado la función Infra Assistant. La clave se utiliza para cifrar un dato particular en la base de datos de Infra Assistant: la clave API para su cuenta de proveedor de IA. Esto ha sido corregido en la versión 2025.6 de Puppet Enterprise, y las notas de la versión 2025.6 tienen pasos de remediación para usuarios de versiones afectadas que no pueden actualizar a la última versión.

Information

Published : 2025-09-24 16:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-10360

Mitre link : CVE-2025-10360

CVE.ORG link : CVE-2025-10360

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2025-10360", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10360", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T16:11:54.833079Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@puppet.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@puppet.com", "affectedData": [{"vendor": "Perforce", "product": "Puppet Enterprise", "versions": [{"status": "affected", "version": "2025.4", "versionType": "custom", "lessThanOrEqual": "2025.5"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-24T16:15:32.797", "references": [{"url": "https://portal.perforce.com/s/cve/a91PA000001Smp7YAC/insufficiently-protected-credentials-in-puppet-enterprise-20254-and-20255", "source": "security@puppet.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@puppet.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account.\u00a0This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version."}, {"lang": "es", "value": "En las versiones 2025.4.0 y 2025.5 de Puppet Enterprise, la clave de cifrado utilizada para cifrar contenido en la base de datos de Infra Assistant no fue excluida de los archivos recopilados por la copia de seguridad de Puppet. La clave solo est\u00e1 presente en el sistema si el usuario tiene una licencia Puppet Enterprise Advanced y ha habilitado la funci\u00f3n Infra Assistant. La clave se utiliza para cifrar un dato particular en la base de datos de Infra Assistant: la clave API para su cuenta de proveedor de IA. Esto ha sido corregido en la versi\u00f3n 2025.6 de Puppet Enterprise, y las notas de la versi\u00f3n 2025.6 tienen pasos de remediaci\u00f3n para usuarios de versiones afectadas que no pueden actualizar a la \u00faltima versi\u00f3n."}], "lastModified": "2026-09-26T00:10:00.127", "sourceIdentifier": "security@puppet.com"}