AZL-112717: CVE-2026-115731 affecting package puppet 7.34.0-1

Q: Who can exploit this vulnerability?

Any client with a CA-signed Puppet agent certificate can submit a crafted report and execute code on the Puppet Server as the Puppet Server service user. If the certificate authority autosigns requests without strong verification, an unauthenticated network attacker may be able to obtain a qualifying certificate.

Q: What access or network action is required for exploitation?

The attacker needs to send a PUT request containing a report with a crafted rich-data type to the Puppet Server's report-processing functionality. A valid CA-signed agent certificate is required unless weak autosigning allows the attacker to acquire one.

Q: What can be done if the affected package cannot be updated immediately?

Restrict access to Puppet Server report submission to trusted, authenticated agents and review certificate authority autosigning behavior. Disable or tightly verify autosigning so untrusted network clients cannot obtain CA-signed agent certificates.

Q: How can administrators assess whether their environment is exposed?

Determine whether Puppet Server is processing reports from agents and whether any agent certificates could be obtained by untrusted parties. Environments that autosign certificate requests without strong verification have additional exposure because unauthenticated network attackers may obtain the certificate needed to submit a malicious report.

Published Nov 3, 2026

Updated

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

Affected Software

1 affected component

azure-linux/puppet<=7.34.0-1

Event History

Nov 3, 2026

Advisory Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115731

Frequently Asked Questions

Who can exploit this vulnerability?

Any client with a CA-signed Puppet agent certificate can submit a crafted report and execute code on the Puppet Server as the Puppet Server service user. If the certificate authority autosigns requests without strong verification, an unauthenticated network attacker may be able to obtain a qualifying certificate.

What access or network action is required for exploitation?

The attacker needs to send a PUT request containing a report with a crafted rich-data type to the Puppet Server's report-processing functionality. A valid CA-signed agent certificate is required unless weak autosigning allows the attacker to acquire one.

What can be done if the affected package cannot be updated immediately?

Restrict access to Puppet Server report submission to trusted, authenticated agents and review certificate authority autosigning behavior. Disable or tightly verify autosigning so untrusted network clients cannot obtain CA-signed agent certificates.

How can administrators assess whether their environment is exposed?

Determine whether Puppet Server is processing reports from agents and whether any agent certificates could be obtained by untrusted parties. Environments that autosign certificate requests without strong verification have additional exposure because unauthenticated network attackers may obtain the certificate needed to submit a malicious report.

AZL-112717: CVE-2026-115731 affecting package puppet 7.34.0-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this vulnerability?

What access or network action is required for exploitation?

What can be done if the affected package cannot be updated immediately?

How can administrators assess whether their environment is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What access or network action is required for exploitation?

What can be done if the affected package cannot be updated immediately?

How can administrators assess whether their environment is exposed?