Multiple security vulnerabilities have been identified in Puppet Server and related configuration-management components, affecting server versions 9.1.0 and 8.17.0 and below, and agent versions 9.2.0 and 8.31.1 and below. The flaws can allow remote code execution and client impersonation on managed infrastructure. The overall risk is high because a compromised server can affect many nodes, especially when automatic certificate signing is enabled.
CVE-2026-115731 (CVSS 9.4 — Critical): The server-side report processing component deserializes agent report data and trusts attacker-controlled type information, allowing a malicious report to trigger code execution on the server. An agent with a signed certificate, or an unauthenticated attacker in automatic signing configurations, can run commands as the server user.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Puppet Server and related configuration-management components, affecting server versions 9.1.0 and 8.17.0 and below, and agent versions 9.2.0 and 8.31.1 and below. The flaws can allow remote code execution and client impersonation on managed infrastructure. The overall risk is high because a compromised server can affect many nodes, especially when automatic certificate signing is enabled.
CVE-2026-115731 (CVSS 9.4 — Critical): The server-side report processing component deserializes agent report data and trusts attacker-controlled type information, allowing a malicious report to trigger code execution on the server. An agent with a signed certificate, or an unauthenticated attacker in automatic signing configurations, can run commands as the server user.[emaillocker id="1283"]
CVE-2026-115732 (CVSS 9.0 — Critical): The authorization component mishandles certificate name matching, allowing one node to impersonate another by using a related hostname. This can enable remote command execution on managed nodes when the impersonated identity is accepted.
These vulnerabilities collectively present a severe risk to configuration-management environments, especially deployments where many nodes are managed and automatic certificate signing is enabled. Organizations that operate affected server or agent components are most at risk. They should prioritize assessing exposure and addressing the flaws before exploitation begins.
We recommend you to update Perforce Puppet Enterprise to version 2023.8.13, 2025.12.1, or 2026.0.1 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]