Perforce Puppet Server: Authorization bypass in trapperkeeper-authorization (CVE-2026-115732)
An authorization bypass vulnerability in the trapperkeeper-authorization component of Puppet Server allows node impersonation and remote command execution via specifically crafted CA-signed certificates. A public exploit is available.
CVE search metadata
CVE search record: CVE-2026-115732. KEV: no. Product: Puppet Server, Puppet Enterprise. Brief: Perforce Puppet Server: Authorization bypass in trapperkeeper-authorization (CVE-2026-115732). Brief link: https://feed.craftedsignal.io/briefs/2026-11-puppet-auth-bypass/
Triage facts
Revision 1- Applicability
- Puppet Server, Puppet Enterprise
- Evidence
- UnknownHigh confidence
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 4, 00:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-115732 is an authorization bypass vulnerability affecting the trapperkeeper-authorization component used by Puppet Server. A client presenting a CA-signed certificate with a name that extends or shortens an authorized hostname can be incorrectly authorized as that host.
Successful exploitation enables node impersonation. In Puppet Enterprise, this facilitates unauthorized access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, issued by the certificate authority via approval or autosign. A public Proof of Concept (PoC) is available on Sploitus.