by Kastro
Paper/Archive/CVE-2026-115731

CVE-2026-115731

Perforce Puppet Enterprise — Report Deserialization Code Execution

CVSS 9.4
critical.is priorityof 100
28
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

Affected

ProductAffectedFixed inSource
Puppet Enterprise2023.8.0 – < 2023.8.132023.8.13CNA
Puppet Enterprise2025.0.0 – < 2025.12.12025.12.1CNA
Puppet Enterprise2026.0.0 – < 2026.0.12026.0.1CNA

Scores by source

Perforce (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

refportal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution