Puppet Bolt privilege escalation vulnerability

CRITICAL 9.8CVE-2023-5214 · GHSA-289m-2964-f8q5 · Published 06/10/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
bolt RubyGems	`< 3.27.4`	`3.27.4`
bolt puppet	`< 3.27.4`	`3.27.4`

Description

In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

NVD description

In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.