CVE-2025-10360 - CVE House
Back to Database
Status published Medium CVE-2025-10360

Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

Vulnerability Description

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10360

Credits & Attribution

No credits recorded in the NVD database.

References

More from Perforce

View All →
CVE-2025-5459
OS Command Injection
High 8.6
CVE-2025-3113
Improper Access Control in Delphix Masking Engine
Critical 9
CVE-2025-2903
Privilege Chaining in Delphix
High 8.5
CVE-2025-1714
Username Enumeration in Gliffy
Medium 6.9
CVE-2025-14591
PII Leak Due to Change in EOR Handling
Medium 5.3

Affected Vendor

Affected Software

Puppet Enterprise
Vulnerable Versions:
2025.4

Timeline

Official Publish: September 24th, 2025
Last Modified: September 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-522

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation