Read the docs
TI-2026-84577 Aliases CVE-2026-115731GHSA-4pxx-8frq-9r4j

Untrusted deserialization in Puppet Enterprise allows code execution

Priority MEDIUM 43CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-502.

Summary

Puppet Enterprise, as used by Puppet Server, is affected from 2023.8.0 before 2023.8.13, from 2025.0.0 before 2025.12.1 and from 2026.0.0 before 2026.0.1. Deserialization of untrusted data (CWE-502) lets a client with any CA-signed agent certificate run code as the Puppet Server service user by submitting a crafted report over PUT. Where the certificate authority autosigns without strong verification, an unauthenticated network attacker can obtain such a certificate.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Partial Puppet Enterprise (Perforce): 2023.8.13, 2025.12.1, 2026.0.1Red Hat: 4 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerforcePuppet Enterprise2023.8.0 to before 2023.8.13; 2025.0.0 to before 2025.12.1; 2026.0.0 to before 2026.0.12023.8.13, 2025.12.1, 2026.0.1Patch availableCNA
  • Puppet Enterprise VendorPerforce Affected 2023.8.0 to before 2023.8.13; 2025.0.0 to before 2025.12.1; 2026.0.0 to before 2026.0.1 Fixed in 2023.8.13, 2025.12.1, 2026.0.1 Patch available CNA

Remediation

Upgrade Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1. Red Hat fixes Satellite 6.16 in RHSA-2026:95655, Satellite Client 6 in RHSA-2026:95653, Satellite 6.17 in RHSA-2026:95656 and Satellite 6.19 in RHSA-2026:95652. Red Hat gives no fix plan for Red Hat Satellite 6 and Red Hat Satellite Client.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Puppet Enterprise (Perforce) Fixed in 2023.8.13, 2025.12.1, 2026.0.1

Red Hat 4 advisories

  • RHSA-2026:95655 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.32.0-1.el8sat, openvox-server-8.18.0-1.el8sat, python-brotli-1.2.1-1.el8pc +11
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +11
  • RHSA-2026:95653 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6 Client Update
    • Satellite Client 6 for RHEL 10 openvox-agent-8.32.0-1.el10sat
    • Satellite Client 6 for RHEL 7 openvox-agent-8.32.0-1.el7sat
    • Satellite Client 6 for RHEL 8 openvox-agent-8.32.0-1.el8sat
    • Satellite Client 6 for RHEL 9 openvox-agent-8.32.0-1.el9sat
  • RHSA-2026:95656 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +9
Show 1 more Red Hat advisories
  • RHSA-2026:95652 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Perforce Puppet Enterprise 2023.8.13, 2025.12.1, 2026.0.1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-84571 Certificate name authorization bypass in Puppet EnterprisePriority MEDIUM 42
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite ClientAffectedNo fix yet
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:95655
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:95655
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:95656
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:95652
Satellite Client 6 for RHEL 10Fixed RHSA-2026:95653
Satellite Client 6 for RHEL 7Fixed RHSA-2026:95653
Satellite Client 6 for RHEL 8Fixed RHSA-2026:95653
Satellite Client 6 for RHEL 9Fixed RHSA-2026:95653
Not affected: 4 products
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-115731
  2. 2026-11-03 1 new reference · CNA
  3. 2026-11-03 Alias added: GHSA-4pxx-8frq-9r4j
  4. 2026-11-04 Affected versions changed · Red Hat
  5. 2026-11-04 CVSS score added · Red Hat
  6. 2026-11-05 Affected versions changed · Red Hat
  7. 2026-11-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +5 · Red Hat
  8. 2026-11-06 Fix available: RHSA-2026:95653 · Red Hat
  9. 2026-11-06 Fix available: RHSA-2026:95652 · Red Hat
  10. 2026-11-06 Fix available: RHSA-2026:95656 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:95655 · Red Hat
  12. 2026-11-06 CISA SSVC decision points changed

References

Other 1

  • TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
  • TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
  • TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
  • TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
  • TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences