Live › vulnerability › CVE-2026-115732
Puppet Server's certificate-name matching in trapperkeeper-authorization can authorize a client holding a CA-signed certificate as a different host whose name it extends or shortens. An attacker can impersonate other nodes and, in Puppet Enterprise, reach certificate-authority administration and run remote commands on managed nodes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Servers running Puppet Server, Puppet Enterprise or OpenVox Server that use trapperkeeper-authorization with plain-string certname rules in auth.conf. An attacker needs network access to the server and a CA-signed certificate (e.g. via open autosign); a cert named evil.target.example.com is then treated as target.example.com. Per the OpenVox project, some non-default configurations could inject exported resources into other agents' catalogs. Teams not running Puppet/OpenVox can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| openvox-server | vendor | < 8.18.0, >= 9.0.0 < 9.2.0 | 8.18.0, 9.2.0 |
8.18.0 / 9.2.08.18.0 (8.x) or 9.2.0 (9.x), or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.
This page as .md · .json · in your agent: get_signal("CVE-2026-115732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.