{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732) · updates",
  "home_page_url": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731",
  "feed_url": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731/feed.json",
  "description": "Puppet by Perforce and the OpenVox fork released coordinated fixes on Nov 3 2026 for two critical bugs found by Neodyme that affect all known Puppet and OpenVox versions, going back at least to open-source Puppet 6.24.0 from July 2021. CVE-2026-115731 lets any client holding a CA-signed agent certificate run arbitrary code on the Puppet/OpenVox server as its service user by submitting a report with a crafted rich-data event, because the event is deserialized into Ruby code. CVE-2026-115732 is a flaw in trapperkeeper-authorization's certificate-name matching that lets a certificate such as evil.target.example.com be authorized as target.example.com, exposing that node's catalog and secrets, and in Puppet Enterprise it can lead to CA administration and commands on managed nodes. Where the CA autosigns certificate requests without strong verification, an unauthenticated attacker can get the certificate both bugs need. Neodyme's writeup shows the server RCE being used to steal the CA signing key and run commands as root on managed agents. Upgrade OpenVox to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0 and openvoxdb 8.18.0 or 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 (Puppet Core 9.1.3, Puppet Server 9.0.24.1), then restart the server. OpenVox says open-source Puppet will not get security updates and recommends migrating.",
  "language": "en",
  "_pwn": {
    "slug": "puppet-openvox-server-rce-impersonation-cve-2026-115731",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731/feed.xml",
    "llms": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731/llms.txt",
    "json": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731#2026-11-03-d6f47e20",
      "url": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731#2026-11-03-d6f47e20",
      "title": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732): OpenVox publishes critical advisories GHSA-ffr6-rwpm-p5wq (server RCE via report event deserialization) and GHSA-q4hm-33rc-572g (client impersonation via flawed hostname check) and releases fixed agent, server and OpenVoxDB versions, coordinated with Puppet by Perforce.",
      "content_text": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732): OpenVox publishes critical advisories GHSA-ffr6-rwpm-p5wq (server RCE via report event deserialization) and GHSA-q4hm-33rc-572g (client impersonation via flawed hostname check) and releases fixed agent, server and OpenVoxDB versions, coordinated with Puppet by Perforce.\n\nSource: https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731#2026-11-03-fca08432",
      "url": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731#2026-11-03-fca08432",
      "title": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732): CVE-2026-115731 and CVE-2026-115732 are published; Puppet ships Puppet Server 9.0.24.1 with Puppet Core 9.1.3 patched for both.",
      "content_text": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732): CVE-2026-115731 and CVE-2026-115732 are published; Puppet ships Puppet Server 9.0.24.1 with Puppet Core 9.1.3 patched for both.\n\nSource: https://help.puppet.com/core/current/Content/PuppetCore/server/release_notes.htm",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://help.puppet.com/core/current/Content/PuppetCore/server/release_notes.htm",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731#2026-11-03-b421b5cb",
      "url": "https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731#2026-11-03-b421b5cb",
      "title": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732): Neodyme publishes its technical writeup, showing the RCE works back to Puppet 6.24.0 and can be chained to steal the CA key and run commands as root on managed agents in Puppet Enterprise.",
      "content_text": "Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732): Neodyme publishes its technical writeup, showing the RCE works back to Puppet 6.24.0 and can be chained to steal the CA key and run commands as root on managed agents in Puppet Enterprise.\n\nSource: https://neodyme.io/en/blog/puppet_rce/",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://neodyme.io/en/blog/puppet_rce/",
      "tags": [
        "critical"
      ]
    }
  ]
}