Skip to content

OSG-SEC-2026-11-06 CRITICAL- Puppet Server vulnerabilities- CVE-2026-115731 and CVE-2026-115732

Dear OSG Security Contacts,

Two critical vulnerabilities affect Puppet Server and related products. CVE-2026-115731 may let a client with a CA-signed agent certificate execute code on the Puppet Server as its service user [1]. CVE-2026-115732 may let a client with a colliding certificate name impersonate another node [2]. Weak certificate autosigning can make either issue reachable by a remote attacker. Public proof-of-concept details for CVE-2026-115731 are available [3].

IMPACTED VERSIONS:

Puppet Enterprise: fixed in 2023.8.13, 2025.12.1, and 2026.0.1 [5][6].

Puppet Core: fixed in 8.22.1 and 9.1.3.

OpenVox Server and OpenVoxDB: affected versions include 8.17.0 and earlier, and 9.1.0 and earlier; fixed in 8.18.0 and 9.2.0. OpenVox Agent affected versions include 8.31.1 and earlier, and 9.2.0 and earlier; fixed in 8.32.0 and 9.3.0.

Debian: Debian issued DSA-6608-1 for the matching report-processing issue. It lists puppet-agent 8.10.0-5+deb13u1 as fixed for Debian 13 (Trixie). Debian’s CVE tracker still shows “check” for both CVEs; CVE-2026-115732 has no confirmed Debian fix/status in the tracker [9][10][11].

Ubuntu: Canonical currently lists affectedness as “Needs evaluation” for Ubuntu 22.04 and older for CVE-2026-115731’s puppet package, and for Ubuntu 24.04, 26.04, and 26.10 for CVE-2026-115732’s puppetserver package. Other listed releases show “Not in release.” These are not confirmations that Ubuntu is affected or fixed [7][8].

Red Hat: Red Hat only supplies puppet through Red Hat Satellite. EPEL only has puppet-6 and does not appear to get security updates. Get updates directly from the Puppet or OpenVox project.

WHAT ARE THE VULNERABILITIES:

CVE-2026-115731 — report deserialization code execution: A client holding a CA-signed agent certificate can submit a crafted report and execute code on the Puppet Server as its service user. If the CA autosigns requests without strong verification, a remote attacker may be able to obtain a certificate. Execution as the service user does not itself mean root access.

CVE-2026-115732 — certificate-name authorization bypass: A CA-signed certificate whose name extends or shortens an authorized hostname may be accepted as that host, enabling node impersonation. In Puppet Enterprise, the impact may extend to CA administration and remote command execution on managed nodes. Exploitation requires a colliding-name certificate issued through autosigning or approval.

WHAT YOU SHOULD DO:

  • Check whether you operate Puppet Server, Puppet Enterprise, or OpenVox and identify the installed product versions.
  • Temporary mitigation for CVE-2026-115731 - Until patched, avoid autosigning certificate requests without strong verification so untrusted clients cannot obtain a CA-signed agent certificate [1].
  • Temporary mitigation for CVE-2026-115731- Until patched, avoid autosigning certificate requests without strong verification, and do not approve CSRs for names that are suffixes/prefixes of existing authorized certnames[2].
  • Upgrade to the vendor-fixed release or erratum for that product and stream. For Debian 13, install puppet-agent 8.10.0-5+deb13u1 or later. For Ubuntu, monitor Canonical’s CVE pages because applicability is still under evaluation for listed releases [7][8].
  • Where practical, restrict Puppet management endpoints to trusted agent networks. Ensure the restrictions preserve required agent reporting and management traffic.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-115731.
[2] https://access.redhat.com/security/cve/cve-2026-115732.
[3] https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/
[4] https://www.puppet.com/products/puppet-enterprise/whats-new.
[5] https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution.
[6] https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass.
[7] https://ubuntu.com/security/CVE-2026-115731.
[8] https://ubuntu.com/security/CVE-2026-115732.
[9] https://lists.debian.org/debian-security-announce/2026/msg00527.html.
[10] https://security-tracker.debian.org/tracker/CVE-2026-115731.
[11] https://security-tracker.debian.org/tracker/CVE-2026-115732.

Please contact the OSG security team at [email protected] if you have any questions or concerns. OSG Security Team