Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732)

Puppet by Perforce and the OpenVox fork released coordinated fixes on Nov 3 2026 for two critical bugs found by Neodyme that affect all known Puppet and OpenVox versions, going back at least to open-source Puppet 6.24.0 from July 2021. CVE-2026-115731 lets any client holding a CA-signed agent certificate run arbitrary code on the Puppet/OpenVox server as its service user by submitting a report with a crafted rich-data event, because the event is deserialized into Ruby code. CVE-2026-115732 is a flaw in trapperkeeper-authorization's certificate-name matching that lets a certificate such as evil.target.example.com be authorized as target.example.com, exposing that node's catalog and secrets, and in Puppet Enterprise it can lead to CA administration and commands on managed nodes. Where the CA autosigns certificate requests without strong verification, an unauthenticated attacker can get the certificate both bugs need. Neodyme's writeup shows the server RCE being used to steal the CA signing key and run commands as root on managed agents. Upgrade OpenVox to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0 and openvoxdb 8.18.0 or 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 (Puppet Core 9.1.3, Puppet Server 9.0.24.1), then restart the server. OpenVox says open-source Puppet will not get security updates and recommends migrating.

Why this severity: Red Hat CVSS 3.1 9.9 for both (AV:N/AC:L/PR:L/S:C); needs a CA-signed agent certificate, which autosign setups may hand out without approval; no known exploitation

Started

Nov 3, 2026

CVEs

CVE-2026-115731CVE-2026-115732

• Ruby
• Java
• Linux
• #Puppet
• #OpenVox
• #Perforce
• RCE
• #Deserialization
• Auth bypass