Vulnerability Database

300,991

Total vulnerabilities in the database

CVE-2016-2788

MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.

Published: Feb 13, 2017
Updated: Nov 9, 2025
CVE: CVE-2016-2788
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-284

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
puppet / marionette_collective	2.7.0	2.7.0.x
puppet / marionette_collective	2.8.0	2.8.0.x
puppet / marionette_collective	2.8.1	2.8.1.x
puppet / marionette_collective	2.8.2	2.8.2.x
puppet / marionette_collective	2.8.3	2.8.3.x
puppet / marionette_collective	2.8.4	2.8.4.x
puppet / marionette_collective	2.8.5	2.8.5.x
puppet / marionette_collective	2.8.6	2.8.6.x
puppet / marionette_collective	2.8.7	2.8.7.x
puppet / marionette_collective	2.8.8	2.8.8.x
puppet / puppet_enterprise	3.8.0	3.8.6
puppet / puppet_enterprise	2016.2.0	2016.2.1

https://puppet.com/security/cve/cve-2016-2788

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo