Read the docs
TI-2026-84571 Aliases CVE-2026-115732GHSA-5jqj-9p78-vmh3

Certificate name authorization bypass in Puppet Enterprise

Priority MEDIUM 42CWE-697Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Puppet Enterprise from 2023.8.0 before 2023.8.13, from 2025.0.0 before 2025.12.1, and from 2026.0.0 before 2026.0.1 is affected. Incorrect authorization (CWE-863) in the certificate name matching of trapperkeeper-authorization, used by Puppet Server, lets a client be authorized as a host whose name its certificate extends or shortens. A remote attacker with low privileges who holds a CA-signed certificate with a colliding name, issued through approval or autosign, can impersonate other nodes. In Puppet Enterprise this can also grant access to certificate authority administration and remote command execution on managed nodes.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00745 55th percentileScored 2026-11-07
Fix Partial Puppet Enterprise (Perforce): 2023.8.13, 2025.12.1, 2026.0.1Red Hat: 3 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerforcePuppet Enterprise2023.8.0 to before 2023.8.13; 2025.0.0 to before 2025.12.1; 2026.0.0 to before 2026.0.12023.8.13, 2025.12.1, 2026.0.1Patch availableCNA
  • Puppet Enterprise VendorPerforce Affected 2023.8.0 to before 2023.8.13; 2025.0.0 to before 2025.12.1; 2026.0.0 to before 2026.0.1 Fixed in 2023.8.13, 2025.12.1, 2026.0.1 Patch available CNA

Remediation

Upgrade Puppet Enterprise to 2023.8.13, 2025.12.1, or 2026.0.1. Red Hat fixes Red Hat Satellite 6.16 for RHEL 8 and RHEL 9 in RHSA-2026:95655, Red Hat Satellite 6.17 for RHEL 9 in RHSA-2026:95656, and Red Hat Satellite 6.19 for RHEL 9 in RHSA-2026:95652. Red Hat lists Red Hat Satellite 6 as affected with no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Puppet Enterprise (Perforce) Fixed in 2023.8.13, 2025.12.1, 2026.0.1

Red Hat 3 advisories

  • RHSA-2026:95655 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.32.0-1.el8sat, openvox-server-8.18.0-1.el8sat, python-brotli-1.2.1-1.el8pc +11
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +11
  • RHSA-2026:95656 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +9
  • RHSA-2026:95652 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Perforce Puppet Enterprise 2023.8.13, 2025.12.1, 2026.0.1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-84577 Untrusted deserialization in Puppet Enterprise allows code executionPriority MEDIUM 43
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:95655
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:95655
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:95656
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:95652
Not affected: 4 products
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-115732
  2. 2026-11-03 Alias added: GHSA-5jqj-9p78-vmh3
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat
  5. 2026-11-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
  6. 2026-11-06 Fix available: RHSA-2026:95652 · Red Hat
  7. 2026-11-06 Fix available: RHSA-2026:95656 · Red Hat
  8. 2026-11-06 Fix available: RHSA-2026:95655 · Red Hat
  9. 2026-11-06 CISA SSVC decision points changed

References

Other 1

  • TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
  • TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
  • TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
  • TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
  • TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences