{"id":"CVE-2026-115732","kind":"vulnerability","aliases":["CVE-2026-115732"],"related":[],"title":"Puppet Server and OpenVox: certificate name matching lets a client impersonate other nodes","description":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.","summary":"Puppet Server's certificate-name matching in trapperkeeper-authorization can authorize a client holding a CA-signed certificate as a different host whose name it extends or shortens. An attacker can impersonate other nodes and, in Puppet Enterprise, reach certificate-authority administration and run remote commands on managed nodes.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"openvox-server","fixed":["8.18.0","9.2.0"],"affected":"< 8.18.0, >= 9.0.0 < 9.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["openvox","puppet-enterprise","puppet-server","runtime","trapperkeeper-authorization"],"not_affected_if":["unknown"],"how_to_check":"Run puppetserver --version (or check the openvox-server package) and compare with 8.18.0 / 9.2.0. Review auth.conf for non-regex certname rules (e.g. allow: target.example.com): before the fix these also matched names like evil.target.example.com. On PE, check the version against Puppet's release notes.","fix":"OpenVox: upgrade openvox-server to 8.18.0 (8.x) or 9.2.0 (9.x), or later. Puppet Enterprise / Puppet Server fixed version: unknown, check Puppet's PE release notes. After upgrading, re-test custom auth.conf rules, which may have relied on the buggy matching.","status":"open","published_at":"2026-11-03T21:17:02+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","triaged_at":"2026-11-03T21:20:31+00:00","updated_at":"2026-11-03T21:22:43+00:00","category":"runtime","confidence":0.55,"triage":{"at":"2026-11-03T21:20:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Puppet Server: certificate name matching lets a client impersonate other nodes","impact":"high","summary":"Puppet Server's certificate-name matching in trapperkeeper-authorization can authorize a client holding a CA-signed certificate as a different host whose name it extends or shortens. An attacker can impersonate other nodes and, in Puppet Enterprise, reach certificate-authority administration and run remote commands on managed nodes.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["puppet-server","puppet-enterprise","trapperkeeper-authorization"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker impersonates nodes and runs remote commands on managed nodes","analyst_note":"Find the affected and fixed Puppet Server and Puppet Enterprise versions and the NVD entry's full advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115732.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Puppet Server or Puppet Enterprise with agents enrolled under a certificate authority. Exploitation needs a client certificate with a colliding name, which the CA issues on approval or through autosign, so autosign-enabled and loosely approved CAs are the most exposed. Sources do not state the affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000696,"input_tokens":4199,"output_tokens":553,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed Puppet Server and Puppet Enterprise versions and the NVD entry's full advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115732.","search":"'-115732':16A,19A '-2026':15A,18A 'access':142C 'administr':79B,147C 'affect':106C 'allow':108C 'approv':169C 'attack':66B 'author':33B,44B,46B,78B,88C,98C,124C,128C,146C,166C 'autosign':171C 'ca':52B,115C 'ca-sign':51B,114C 'certif':5A,38B,54B,77B,92C,117C,145C,158C,165C 'certificate-author':76B,144C 'certificate-nam':37B,91C 'client':10A,48B,110C 'collid':161C 'command':83B,150C 'cve':14A,17A 'differ':57B 'enabl':133C 'enterpris':26B,74B,141C 'execut':151C 'exploit':155C 'extend':62B,120C 'hold':49B,112C 'host':58B,131C 'hostnam':125C 'imperson':11A,68B,134C 'incorrect':87C 'issu':167C 'let':8A 'manag':85B,153C 'match':7A,40B,94C 'name':6A,39B,60B,93C,119C,162C 'node':13A,70B,86B,137C,154C 'openvox':4A,21A,23B 'openvox-server':20A 'product':107C 'puppet':1A,25B,28B,34B,73B,102C,140C 'puppet-enterpris':24B 'puppet-serv':27B 'reach':75B 'remot':82B,149C 'requir':156C 'run':81B 'runtim':30B 'server':2A,22A,29B,35B,103C 'shorten':64B,122C 'sign':53B,116C 'trapperkeep':32B,43B,97C 'trapperkeeper-author':31B,42B,96C 'use':100C 'whose':59B,118C","nicknames":[],"mitigations":[],"who_affected":"Servers running Puppet Server, Puppet Enterprise or OpenVox Server that use trapperkeeper-authorization with plain-string certname rules in auth.conf. An attacker needs network access to the server and a CA-signed certificate (e.g. via open autosign); a cert named evil.target.example.com is then treated as target.example.com. Per the OpenVox project, some non-default configurations could inject exported resources into other agents' catalogs. Teams not running Puppet/OpenVox can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["openvoxserver"],"ptokens":["openvox","server"],"labels":["critical","openvox","puppetenterprise","puppetserver","runtime","trapperkeeperauthorization"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@puppet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115732","severity":null,"published_at":"2026-11-03T21:17:02+00:00","modified_at":"2026-11-03T21:17:02+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","fetched_at":"2026-11-03T21:19:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115732:1566","url":null,"severity":null,"published_at":"2026-11-03T21:22:43+00:00","modified_at":"2026-11-03T21:22:43+00:00","first_seen_at":"2026-11-03T21:22:43+00:00","fetched_at":"2026-11-03T21:22:43+00:00","note":"NVD page unreadable. OpenVox project (oss-security + voxpupuli blog, 2026-11-03) describes this flaw in trapperkeeper-authorization; their CVE numbers were still 'pending', so the match to CVE-2026-115732 is likely but not confirmed. Fixed: openvox-server 8.18.0/9.2.0 (tk-authorization 2.5.0 per changelog). Puppet Server/PE fixed versions NOT found: Puppet says PE was coordinated, but no PE release note names this CVE; Puppet OSS gets no fixes. Not verified. Settle with GHSA-q4hm-33rc-572g (unreadable) or a PE 2026.0.x/2025.12.x note."}],"documents":[{"id":60955,"url":"https://www.openwall.com/lists/oss-security/2026/11/03/14","title":"OpenVox Server RCE and client impersonation vulnerabilities (oss-security)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":60956,"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","title":"Critical CVE Updates in all known versions of Puppet and OpenVox","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":60951,"url":"https://help.puppet.com/core/current/content/puppetcore/PuppetReleaseNotes/release_notes_puppet_x-9-1-3.htm","title":"Puppet Core 9.1.3 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}