Loading vulnerability…
Puppet Report Deserialization Code Execution
CVE-2026-115731 is an untrusted-data deserialization vulnerability in Puppet report-processing code used by Puppet Server, affecting Puppet and OpenVox servers, including Puppet Enterprise deployments. Attacker-controlled report event data reaches Puppet::Pops::Serialization::FromDataConverter.convert, where a crafted rich-data type is parsed and instantiated. The resulting Ruby code-generation path reaches class_eval, enabling arbitrary code execution as the Puppet Server service user. Exploitation requires a PUT report submission authenticated with any accepted CA-signed agent certificate. Weak certificate autosigning can allow an initially unauthenticated attacker to obtain the required certificate.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of Puppet Server within the privileges of its service account, typically the puppet user. This can expose server-accessible data, secrets, and management functions. Where that account can access the certificate authority signing key, an attacker can issue certificates with serverAuth and clientAuth extended key usages, potentially enabling command execution on managed hosts under certain orchestration configurations.
If you can’t patch tonight, do this now.
Disable certificate autosigning that lacks strong identity verification, and verify agent identities before approving certificate requests. Restrict network access to report-submission endpoints to trusted systems. These controls reduce exposure but do not prevent exploitation by an attacker who already possesses an accepted CA-signed agent certificate.
Patch, then assume compromise.
Apply the vendor security update addressing CVE-2026-115731 for the deployed Puppet or OpenVox distribution. Perforce has announced security releases for Puppet Core, Puppet Enterprise, and Puppet Enterprise Advanced. Exact affected and fixed release numbers are not available in the supplied information; verify the applicable fixed version with the vendor before upgrading.
No public exploits tracked yet. Mallory keeps watching.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.