---
id: "CVE-2026-115732"
kind: "vulnerability"
aliases: ["CVE-2026-115732"]
title: "Puppet Server and OpenVox: certificate name matching lets a client impersonate other nodes"
severity: "critical"
cvss: 9.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "openvox-server", "fixed": ["8.18.0", "9.2.0"], "affected": "< 8.18.0, >= 9.0.0 < 9.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["openvox", "puppet-enterprise", "puppet-server", "runtime", "trapperkeeper-authorization"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T21:17:02+00:00"
first_seen_at: "2026-11-03T21:19:08+00:00"
updated_at: "2026-11-03T21:22:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115732", "first_seen_at": "2026-11-03T21:19:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:22:43+00:00"}]
---

# Puppet Server and OpenVox: certificate name matching lets a client impersonate other nodes

Puppet Server's certificate-name matching in trapperkeeper-authorization can authorize a client holding a CA-signed certificate as a different host whose name it extends or shortens. An attacker can impersonate other nodes and, in Puppet Enterprise, reach certificate-authority administration and run remote commands on managed nodes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:openvox-server affected < 8.18.0, >= 9.0.0 < 9.2.0 fixed 8.18.0, 9.2.0

## How to check

Run puppetserver --version (or check the openvox-server package) and compare with 8.18.0 / 9.2.0. Review auth.conf for non-regex certname rules (e.g. allow: target.example.com): before the fix these also matched names like evil.target.example.com. On PE, check the version against Puppet's release notes.

## Fix

OpenVox: upgrade openvox-server to 8.18.0 (8.x) or 9.2.0 (9.x), or later. Puppet Enterprise / Puppet Server fixed version: unknown, check Puppet's PE release notes. After upgrading, re-test custom auth.conf rules, which may have relied on the buggy matching.

## Timeline

- 2026-11-03T21:19:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115732
- 2026-11-03T21:22:43+00:00 analyst — NVD page unreadable. OpenVox project (oss-security + voxpupuli blog, 2026-11-03) describes this flaw in trapperkeeper-authorization; their CVE numbers were still 'pending', so the match to CVE-2026-115732 is likely but not confirmed. Fixed: openvox-server 8.18.0/9.2.0 (tk-authorization 2.5.0 per changelog). Puppet Server/PE fixed versions NOT found: Puppet says PE was coordinated, but no PE release note names this CVE; Puppet OSS gets no fixes. Not verified. Settle with GHSA-q4hm-33rc-572g (unreadable) or a PE 2026.0.x/2025.12.x note.

## Documents

- [advisory] OpenVox Server RCE and client impersonation vulnerabilities (oss-security) https://www.openwall.com/lists/oss-security/2026/11/03/14
- [advisory] Critical CVE Updates in all known versions of Puppet and OpenVox https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/
- [mentions] Puppet Core 9.1.3 release notes https://help.puppet.com/core/current/content/puppetcore/PuppetReleaseNotes/release_notes_puppet_x-9-1-3.htm

## From the sources

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_