Puppet: Deserialization of untrusted data in report-processing (CVE-2026-115731)
A deserialization vulnerability in Puppet report-processing allows arbitrary code execution via crafted PUT requests.
CVE search metadata
CVE search record: CVE-2026-115731. KEV: no. Brief: Puppet: Deserialization of untrusted data in report-processing (CVE-2026-115731). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-115731/
CVE search record: CVE-2026-115732. KEV: no. Brief: Puppet: Deserialization of untrusted data in report-processing (CVE-2026-115731). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-115731/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- High
- Sources
- 11 public sources
- Freshness
- Revision 2Nov 4, 12:01 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Likely
Revision history 1 entry · Revision 2
- Revision 2
new vendor
Changed: affected_vendors, claim_state, lastmod, references, updates
Sources: 1
CVE-2026-115731 involves a deserialization vulnerability in the report-processing code of Puppet, as used by Puppet Server. A client holding a CA-signed agent certificate can execute arbitrary code on the Puppet Server as the service user by submitting a report containing a crafted rich-data type via a PUT request. In environments where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain a certificate to exploit this vulnerability. A PoC exploit has been published on Sploitus.