Perforce Puppet Server: Authorization bypass in trapperkeeper-authorization (CVE-2026-115732)

hello@craftedsignal.io — Wed, 04 Nov 2026 00:47:08 +0000

CVE-2026-115732 is an authorization bypass vulnerability affecting the trapperkeeper-authorization component used by Puppet Server. A client presenting a CA-signed certificate with a name that extends or shortens an authorized hostname can be incorrectly authorized as that host.

Successful exploitation enables node impersonation. In Puppet Enterprise, this facilitates unauthorized access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, issued by the certificate authority via approval or autosign. A public Proof of Concept (PoC) is available on Sploitus.

Puppet: Deserialization of untrusted data in report-processing (CVE-2026-115731)

hello@craftedsignal.io — Wed, 04 Nov 2026 00:46:57 +0000

CVE-2026-115731 involves a deserialization vulnerability in the report-processing code of Puppet, as used by Puppet Server. A client holding a CA-signed agent certificate can execute arbitrary code on the Puppet Server as the service user by submitting a report containing a crafted rich-data type via a PUT request. In environments where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain a certificate to exploit this vulnerability. A PoC exploit has been published on Sploitus.

Perforce - CraftedSignal Threat Feed

Perforce Puppet Server: Authorization bypass in trapperkeeper-authorization (CVE-2026-115732)

Puppet: Deserialization of untrusted data in report-processing (CVE-2026-115731)