# Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732) · pwn.watch

> Puppet by Perforce and the OpenVox fork released coordinated fixes on Nov 3 2026 for two critical bugs found by Neodyme that affect all known Puppet and OpenVox versions, going back at least to open-source Puppet 6.24.0 from July 2021. CVE-2026-115731 lets any client holding a CA-signed agent certificate run arbitrary code on the Puppet/OpenVox server as its service user by submitting a report with a crafted rich-data event, because the event is deserialized into Ruby code. CVE-2026-115732 is a flaw in trapperkeeper-authorization's certificate-name matching that lets a certificate such as evil.target.example.com be authorized as target.example.com, exposing that node's catalog and secrets, and in Puppet Enterprise it can lead to CA administration and commands on managed nodes. Where the CA autosigns certificate requests without strong verification, an unauthenticated attacker can get the certificate both bugs need. Neodyme's writeup shows the server RCE being used to steal the CA signing key and run commands as root on managed agents. Upgrade OpenVox to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0 and openvoxdb 8.18.0 or 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 (Puppet Core 9.1.3, Puppet Server 9.0.24.1), then restart the server. OpenVox says open-source Puppet will not get security updates and recommends migrating.

Page: https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731 · generated 2026-11-04T13:03:17.659Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Puppet Server / Puppet Enterprise (Perforce) and OpenVox (openvox-agent, openvox-server, openvoxdb)
- Started: 2026-11-03
- CVEs: CVE-2026-115731, CVE-2026-115732
- Affected: OpenVox Agent <= 8.31.1 and <= 9.2.0; OpenVox Server and OpenVoxDB <= 8.17.0 and <= 9.1.0; Puppet Enterprise releases before 2023.8.13, 2025.12.1 and 2026.0.1; Open-source Puppet (no fix; OpenVox recommends migrating)
- Fixed in: openvox-agent 8.32.0 / 9.3.0; openvox-server 8.18.0 / 9.2.0; openvoxdb 8.18.0 / 9.2.0; Puppet Enterprise 2023.8.13 / 2025.12.1 / 2026.0.1; Puppet Core 9.1.3 with Puppet Server 9.0.24.1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731/feed.xml
- JSON Feed: https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731.json
- This file: https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731/llms.txt

## Updates (newest first)
- 2026-11-03: OpenVox publishes critical advisories GHSA-ffr6-rwpm-p5wq (server RCE via report event deserialization) and GHSA-q4hm-33rc-572g (client impersonation via flawed hostname check) and releases fixed agent, server and OpenVoxDB versions, coordinated with Puppet by Perforce. (https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/)
- 2026-11-03: CVE-2026-115731 and CVE-2026-115732 are published; Puppet ships Puppet Server 9.0.24.1 with Puppet Core 9.1.3 patched for both. (https://help.puppet.com/core/current/Content/PuppetCore/server/release_notes.htm)
- 2026-11-03: Neodyme publishes its technical writeup, showing the RCE works back to Puppet 6.24.0 and can be chained to steal the CA key and run commands as root on managed agents in Puppet Enterprise. (https://neodyme.io/en/blog/puppet_rce/)

## Fix brief
# Security brief: Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732)

Source: https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731 · status: live · severity: critical · updated Nov 4, 2026, 11:00 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Puppet by Perforce and the OpenVox fork released coordinated fixes on Nov 3 2026 for two critical bugs found by Neodyme that affect all known Puppet and OpenVox versions, going back at least to open-source Puppet 6.24.0 from July 2021. CVE-2026-115731 lets any client holding a CA-signed agent certificate run arbitrary code on the Puppet/OpenVox server as its service user by submitting a report with a crafted rich-data event, because the event is deserialized into Ruby code. CVE-2026-115732 is a flaw in trapperkeeper-authorization's certificate-name matching that lets a certificate such as evil.target.example.com be authorized as target.example.com, exposing that node's catalog and secrets, and in Puppet Enterprise it can lead to CA administration and commands on managed nodes. Where the CA autosigns certificate requests without strong verification, an unauthenticated attacker can get the certificate both bugs need. Neodyme's writeup shows the server RCE being used to steal the CA signing key and run commands as root on managed agents. Upgrade OpenVox to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0 and openvoxdb 8.18.0 or 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 (Puppet Core 9.1.3, Puppet Server 9.0.24.1), then restart the server. OpenVox says open-source Puppet will not get security updates and recommends migrating.

Severity detail: Red Hat CVSS 3.1 9.9 for both (AV:N/AC:L/PR:L/S:C); needs a CA-signed agent certificate, which autosign setups may hand out without approval; no known exploitation

- Product: Puppet Server / Puppet Enterprise (Perforce) and OpenVox (openvox-agent, openvox-server, openvoxdb)
- CVE / advisory ids: CVE-2026-115731, CVE-2026-115732

## Affected versions
- OpenVox Agent <= 8.31.1 and <= 9.2.0
- OpenVox Server and OpenVoxDB <= 8.17.0 and <= 9.1.0
- Puppet Enterprise releases before 2023.8.13, 2025.12.1 and 2026.0.1
- Open-source Puppet (no fix; OpenVox recommends migrating)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- openvox-agent 8.32.0 / 9.3.0
- openvox-server 8.18.0 / 9.2.0
- openvoxdb 8.18.0 / 9.2.0
- Puppet Enterprise 2023.8.13 / 2025.12.1 / 2026.0.1
- Puppet Core 9.1.3 with Puppet Server 9.0.24.1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Check the installed versions with `puppet --version` and `puppetserver --version` (or your package manager for openvox-agent, openvox-server and openvoxdb). Upgrade OpenVox to openvox-agent 8.32.0 / 9.3.0, openvox-server 8.18.0 / 9.2.0 and openvoxdb 8.18.0 / 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1, then restart the server so the fixed code is loaded. If you have custom rules in `auth.conf`, check them after upgrading, since they may have relied on the buggy matching. Until patched, limit network access to port 8140 to the hosts that need it, disable autosign or require strong verification for certificate requests, and do not approve certificate requests whose names extend an existing certname. Open-source Puppet gets no fix; migrate to OpenVox.

## Latest updates
- Nov 3, 2026: OpenVox publishes critical advisories GHSA-ffr6-rwpm-p5wq (server RCE via report event deserialization) and GHSA-q4hm-33rc-572g (client impersonation via flawed hostname check) and releases fixed agent, server and OpenVoxDB versions, coordinated with Puppet by Perforce.
- Nov 3, 2026: CVE-2026-115731 and CVE-2026-115732 are published; Puppet ships Puppet Server 9.0.24.1 with Puppet Core 9.1.3 patched for both.
- Nov 3, 2026: Neodyme publishes its technical writeup, showing the RCE works back to Puppet 6.24.0 and can be chained to steal the CA key and run commands as root on managed agents in Puppet Enterprise.

## Advisories
- [Authenticated RCE on OpenVox server via Event Deserialization (GHSA-ffr6-rwpm-p5wq)](https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq) (OpenVox (GitHub))
- [Flawed Hostname Check allows Puppet Client Impersonation (GHSA-q4hm-33rc-572g)](https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g) (OpenVox (GitHub))
- [Critical CVE Updates in all known versions of Puppet and OpenVox](https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/) (Vox Pupuli)
- [Puppet Server release notes (9.0.24.1)](https://help.puppet.com/core/current/Content/PuppetCore/server/release_notes.htm) (Puppet by Perforce)
- [CVE-2026-115731](https://www.cve.org/CVERecord?id=CVE-2026-115731) (CVE.org)
- [CVE-2026-115732](https://access.redhat.com/security/cve/cve-2026-115732) (Red Hat)
- [OpenVox Server RCE and client impersonation vulnerabilities](https://www.openwall.com/lists/oss-security/2026/11/03/14) (oss-security)

## Write-ups & news
- [Pulling the right strings for RCE on a Puppet](https://neodyme.io/en/blog/puppet_rce/)
- [Pulling the right strings for RCE on a Puppet (discussion)](https://news.ycombinator.com/item?id=50363481)

---
Machine-readable: https://pwn.watch/i/puppet-openvox-server-rce-impersonation-cve-2026-115731.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.