{"id":"CVE-2026-115732","title":"Certificate Name Authorization Bypass","summary":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized …","severity":"critical","cvss":9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-863","CWE-697"],"vendor":"Perforce","product":"Puppet Enterprise","affected":["puppet_enterprise >= 2023.8.0 < 2023.8.13","puppet_enterprise >= 2025.0.0 < 2025.12.1","puppet_enterprise >= 2026.0.0 < 2026.0.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-06T19:38:25.135829Z"},"published":"2026-11-03","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:39:07.902Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115732","references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass"}],"tags":["cve.org"],"epss":0.00745,"epssPercentile":0.5503,"ingestedAt":"2026-11-05T20:33:06.452Z","slug":"CVE-2026-115732","body":"## Overview\n\nIncorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.\n\n## Affected\n\n- `puppet_enterprise >= 2023.8.0 < 2023.8.13`\n- `puppet_enterprise >= 2025.0.0 < 2025.12.1`\n- `puppet_enterprise >= 2026.0.0 < 2026.0.1`\n\n## Remediation\n\nUpgrade to Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1 as applicable. The fix ships to every service that uses the library.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":49.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}