CVE-2012-3408: lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use o...

Security readout for executives and security teams

This issue affects old Puppet deployments that used IP addresses as agent certificate names. If an IP address was reused, an attacker who obtained that address might be able to impersonate the previous Puppet agent. The sources do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in legacy Puppet or Puppet Enterprise environments below the fixed versions, especially where agents used IP-address certnames and networks reuse IPs through DHCP, cloud redeployment, or host turnover. Treat this as a legacy identity-trust risk. It is not supported by active-exploitation evidence in the bundle, but affected Puppet environments can undermine configuration-management trust if IP-based identities still exist. Mitigation focus: Upgrade Puppet to 2.7.18 or later where applicable.; Upgrade Puppet Enterprise to 2.5.2 or later where applicable.; Avoid using IP addresses as Puppet agent certnames..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.