PT-2026-136439
CVE-2026-115731
·
Published
2026-11-03
·
Updated
2026-11-05
Description by
CVSS 4.0
9.4
CriticalMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Puppet Server versions prior to 2023.8.13
Puppet Server versions prior to 2025.12.1
Puppet Server versions prior to 2026.0.1
Description
Deserialization of untrusted data in the report-processing code allows a client possessing any CA-signed agent certificate to execute arbitrary code on the server as its service user. This is achieved by submitting a report containing a crafted rich-data type via a PUT request. If the certificate authority autosigns requests without strong verification, an unauthenticated network attacker may be able to obtain a required certificate.
Recommendations
Update to version 2023.8.13 and restart puppetserver.
Update to version 2025.12.1 and restart puppetserver.
Update to version 2026.0.1 and restart puppetserver.
Found an issue in the description? Have something to add? Feel free to write us 👾