CVE-2015-1426
Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata
CVE-2015-1426 is a low vulnerability (CVSS 2.1) in Puppet Facter, published February 23, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in facter 2.4.1.
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Exploit likelihood
What each source reports
NVD Score used
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
CVE-2015-1426- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
CVE-2015-1426- Updated
- 2026-11-02
EUVDEUVD-2022-4268 No score
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
EUVD-2022-4268- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j436-h7hm-rx46 No score
Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
GHSA-j436-h7hm-rx46- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
CVE-2015-1426- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1426 No score
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
DEBIAN-CVE-2015-1426- Updated
- 2026-11-02
OSVGHSA-j436-h7hm-rx46 No score
Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
GHSA-j436-h7hm-rx46- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1426 No score
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
- Record
UBUNTU-CVE-2015-1426- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
facterRubyGems |
1.6.0 up to 2.4.1 | 2.4.1 |
facterDebian:12 |
before 2.4.4-1 | 2.4.4-1 |
facterDebian:13 |
before 2.4.4-1 | 2.4.4-1 |
facterRubyGems |
1.6.0 up to 2.4.1, plus listed versions 1.6.11.6.101.6.111.6.121.6.12.rc1 Show 45 moreShow less1.6.12.rc21.6.131.6.13.rc11.6.141.6.14.rc11.6.151.6.15.rc11.6.161.6.171.6.17.rc11.6.181.6.18.rc11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.0.rc11.7.0.rc21.7.11.7.1.rc11.7.21.7.2.rc11.7.31.7.3.rc11.7.41.7.4.rc11.7.51.7.5.rc11.7.5.rc21.7.62.0.12.0.1.rc12.0.1.rc22.0.1.rc32.0.1.rc42.0.22.1.02.2.02.3.02.4.0 |
2.4.1 |
facterUbuntu:14.04:LTS |
All versions, plus listed versions 1.7.0-1ubuntu11.7.2-1ubuntu11.7.3-1ubuntu11.7.5-1ubuntu1 |
None known |
facterUbuntu:26.10 |
All versions, plus listed versions 4.10.0-1build1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
puppetlabs.com/security/cve/cve-2015-1426
nvd.nist.gov/vuln/detail/CVE-2015-1426
github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2015-1426.yml
web.archive.org/web/20150906195742/http://puppetlabs.com/security/cve/cve-2015-1426
puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata