EN PT-BR
← Voltar ao feed
critical

PoC Published for Critical Puppet Server RCE Chain (CVE-2026-115731, CVE-2026-115732)

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 23:17 · coletado há 1 hora

A public proof-of-concept exploit is now available for CVE-2026-115731, a critical Puppet Server remote code execution flaw rated CVSS 9.4, affecting OpenVox and Perforce Puppet Enterprise. The bug allows any agent with a signed certificate to achieve code execution via report deserialization, and a second flaw, CVE-2026-115732 (CVSS 9.0), lets one node impersonate another, enabling remote command execution on managed nodes. In autosign-enabled environments—common in enterprise deployments—the attack chain becomes fully unauthenticated, since an attacker can request a certificate and then exploit the deserialization bug. Vox Pupuli, Perforce, and researcher Neodyme disclosed the issues on November 3, 2026, alongside a GitHub security advisory (GHSA-ffr6-rwpm-p5wq) that includes a working malicious report sample. No in-the-wild exploitation has been confirmed yet, but the public PoC significantly shortens the window before attacks begin.

Entenda a falha

A vulnerabilidade

CVE-2026-115731 (CVSS 4.0 9.4) is a remote code execution flaw in Puppet Server, affecting OpenVox and Perforce Puppet Enterprise. Any agent holding a signed certificate can run code on the server as the puppet user, which exposes the CA signing key. With autosign enabled the chain needs no authentication, because the attacker can request a certificate first. CVE-2026-115732 (CVSS 9.0) is in the trapperkeeper-authorization library: plain hostname rules act as wildcards, so a certificate for evil.target.example.com can impersonate target.example.com. In Puppet Enterprise this can lead to command execution on managed nodes. A third critical issue in the container-openvoxdb image let any certificate reach the API. Affected: OpenVox Server up to 9.1.0 and 8.17.0, OpenVox Agent up to 9.2.0 and 8.31.1, Puppet Enterprise before 2023.8.13, 2025.12.1 and 2026.0.1. Fixed in openvox-server and openvoxdb 8.18.0 or 9.2.0, openvox-agent 8.32.0 or 9.3.0, and the Puppet Enterprise versions above.

Como funciona

After each run, an agent sends a JSON report to the server. Events in that report may include a serialized Ruby object, and the server turns that text back into objects while processing the report. The server trusts a type name supplied in the event, and that name eventually reaches a Ruby class_eval call. A crafted event therefore makes code run on the server during report handling. For CVE-2026-115732, the authorization library compares the certificate name against rules that were meant to be exact hostnames, but it matches them as wildcards, so a longer name passes the check.

Por que é vulnerável

CVE-2026-115731 is unsafe deserialization: the server accepts an attacker-controlled type name from report data and lets it reach class_eval without restricting it. CVE-2026-115732 is a logic error in trapperkeeper-authorization, which treated plain hostname rules as wildcards. The container-openvoxdb bug came from a startup script that failed because a tool was missing, leaving the allowlist unenforced so any certificate was accepted. The articles do not explain why these went unnoticed or detail the code changes. They only warn that some custom auth.conf rules may have depended on the old buggy behavior and should be reviewed after upgrading.

Onde está

The deserialization path ends at a Ruby class_eval call in openvox-server, and the authorization bug is in the trapperkeeper-authorization library; the details are in GitHub advisory GHSA-ffr6-rwpm-p5wq.

Como foi descoberta

Vox Pupuli, Perforce and a researcher at Neodyme disclosed the issues on November 3, 2026, together with patched releases and the GitHub advisory GHSA-ffr6-rwpm-p5wq. Neodyme also published its own write-up on Puppet RCE. The articles do not say how the flaws were originally found or when they were first reported. No exploitation in the wild has been confirmed so far.

PoC pública

A working proof of concept for CVE-2026-115731 is public: the OpenVox advisory GHSA-ffr6-rwpm-p5wq includes a malicious report that runs a shell command on the server, and it walks through the vulnerable code path. It demonstrates code execution by an agent with a signed certificate, and the chain is unauthenticated where autosign is on. It is a working exploit, not just a crash. Treat patching as urgent, since attackers can read the same details.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:09.

Detalhes técnicos

CVE-2026-115731 stems from report deserialization: agents send JSON reports after each run, and a malicious event object can embed a serialized Ruby object. The server trusts an attacker-supplied type name that reaches a Ruby class_eval call, granting direct code execution as the puppet user and exposing the CA signing key. CVE-2026-115732 arises from the trapperkeeper-authorization library treating plain hostname rules as wildcards, so a certificate like evil.target.example.com can impersonate target.example.com. A related third issue affects the container-openvoxdb image, where a broken startup script allowed any certificate to access the API. Vox Pupuli states all known Puppet implementations are vulnerable, including OpenVox Server ≤9.1.0/≤8.17.0, OpenVox Agent ≤9.2.0/≤8.31.1, and Puppet Enterprise before 2023.8.13, 2025.12.1 and 2026.0.1; Open Source Puppet will not receive further updates.

Remediação

Upgrade immediately to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0, openvoxdb 8.18.0 or 9.2.0 (including the container image), or Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1. If immediate patching is not possible, restrict server access to necessary networks, disable or tighten autosign, and review custom auth.conf rules after upgrading since some may rely on the now-fixed buggy behavior.

Linha do tempo

  1. securityonline.info ↗ · pub. 03/11/2026 23:17 · coletado 04/11 08:52 primeiro registro

    PoC Published for Critical Puppet Server RCE Chain (CVE-2026-115731, CVE-2026-115732)

    ler a análise desta fonte

    A public proof-of-concept exploit is now available for CVE-2026-115731, a critical Puppet Server remote code execution flaw rated CVSS 9.4, affecting OpenVox and Perforce Puppet Enterprise. The bug allows any agent with a signed certificate to achieve code execution via report deserialization, and a second flaw, CVE-2026-115732 (CVSS 9.0), lets one node impersonate another, enabling remote command execution on managed nodes. In autosign-enabled environments—common in enterprise deployments—the attack chain becomes fully unauthenticated, since an attacker can request a certificate and then exploit the deserialization bug. Vox Pupuli, Perforce, and researcher Neodyme disclosed the issues on November 3, 2026, alongside a GitHub security advisory (GHSA-ffr6-rwpm-p5wq) that includes a working malicious report sample. No in-the-wild exploitation has been confirmed yet, but the public PoC significantly shortens the window before attacks begin.

    Technical Details

    CVE-2026-115731 stems from report deserialization: agents send JSON reports after each run, and a malicious event object can embed a serialized Ruby object. The server trusts an attacker-supplied type name that reaches a Ruby class_eval call, granting direct code execution as the puppet user and exposing the CA signing key. CVE-2026-115732 arises from the trapperkeeper-authorization library treating plain hostname rules as wildcards, so a certificate like evil.target.example.com can impersonate target.example.com. A related third issue affects the container-openvoxdb image, where a broken startup script allowed any certificate to access the API. Vox Pupuli states all known Puppet implementations are vulnerable, including OpenVox Server ≤9.1.0/≤8.17.0, OpenVox Agent ≤9.2.0/≤8.31.1, and Puppet Enterprise before 2023.8.13, 2025.12.1 and 2026.0.1; Open Source Puppet will not receive further updates.

    Remediation

    Upgrade immediately to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0, openvoxdb 8.18.0 or 9.2.0 (including the container image), or Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1. If immediate patching is not possible, restrict server access to necessary networks, disable or tighten autosign, and review custom auth.conf rules after upgrading since some may rely on the now-fixed buggy behavior.