Live › vulnerability › CVE-2026-115731
Puppet Server deserializes untrusted data in its report-processing code, so a crafted rich-data type in a report submitted by PUT request can run arbitrary code. Any client holding a CA-signed agent certificate can exploit it, and an unauthenticated attacker can get such a certificate where the CA autosigns without strong verification.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams running Puppet Server that accept agent reports over PUT. Exposure is highest where the CA autosigns certificate requests without strong verification, because an unauthenticated network attacker can then obtain a valid agent certificate. Installations that do not autosign and restrict who can request certificates are harder to reach, though the sources do not say how much this reduces risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| puppet-core | vendor | unknown (vendor gives no range) | 9.1.3 |
9.1.3 (release notes list CVE-2026-115731 as fixed, PA-9473)9.0.17) do not mention itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
This page as .md · .json · in your agent: get_signal("CVE-2026-115731")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.