CVE-2026-115731Critical· 9.4▾ MidnightDeserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as i…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
puppet_enterprise >= 2023.8.0 < 2023.8.13puppet_enterprise >= 2025.0.0 < 2025.12.1puppet_enterprise >= 2026.0.0 < 2026.0.1Upgrade to a release that bundles puppet-agent 8.22.2 or 9.1.3 (Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1) and restart puppet server so the fixed code is loaded.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115732Critical· 9.0Certificate Name Authorization Bypass
CVE-2026-85979High· 8.6Affected versions of Puppet Enterprise contain a command injection vulnerability
CVE-2026-85978Critical· 9.8An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform
CVE-2024-32030High· 8.1Kafka UI is an Open-Source Web UI for Apache Kafka Management
CVE-2021-29505High· 7.5XStream is software for serializing Java objects to XML and back again
CVE-2021-21345Medium· 5.8XStream is a Java library to serialize objects to XML and back again