---
id: CVE-2026-115732
title: Certificate Name Authorization Bypass
summary: >-
  Incorrect authorization in the certificate-name matching of
  trapperkeeper-authorization, as used by Puppet Server, in the affected
  products, allows a client that holds a CA-signed certificate whose name
  extends or shortens an authorized …
severity: critical
cvss: 9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-863
  - CWE-697
vendor: Perforce
product: Puppet Enterprise
affected:
  - puppet_enterprise >= 2023.8.0 < 2023.8.13
  - puppet_enterprise >= 2025.0.0 < 2025.12.1
  - puppet_enterprise >= 2026.0.0 < 2026.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T19:38:25.135829Z'
published: '2026-11-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:39:07.902Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115732'
references:
  - url: >-
      https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass
tags:
  - cve.org
epss: 0.00745
epssPercentile: 0.5503
ingestedAt: '2026-11-05T20:33:06.452Z'
---

## Overview

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.

## Affected

- `puppet_enterprise >= 2023.8.0 < 2023.8.13`
- `puppet_enterprise >= 2025.0.0 < 2025.12.1`
- `puppet_enterprise >= 2026.0.0 < 2026.0.1`

## Remediation

Upgrade to Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1 as applicable. The fix ships to every service that uses the library.