DEBIAN-CVE-2026-115731: Debian/puppet-agent vulnerability

Q: Who can exploit this vulnerability?

Any client holding a CA-signed Puppet agent certificate can submit a crafted report to execute code on the Puppet Server as its service user. If certificate autosigning lacks strong verification, an unauthenticated network attacker may be able to obtain a qualifying certificate first.

Q: What access and attack path are required?

The attacker needs network access to submit a PUT request containing a report with a crafted rich-data type. Exploitation targets the Puppet Server report-processing code rather than the agent itself.

Q: What can be done while patching is not immediately possible?

Ensure certificate autosigning performs strong verification, since weak autosigning can let unauthenticated attackers obtain the certificate needed for exploitation. Restrict access to the Puppet Server report submission interface to trusted, authenticated agent networks.

Published Nov 3, 2026

Updated

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

Affected Software

2 affected componentsFixes available

debian/puppet-agent<7.23.0-1+deb12u1

7.23.0-1+deb12u1

debian/puppet-agent<8.10.0-5+deb13u1

8.10.0-5+deb13u1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/puppet-agent to a version that resolves this vulnerability.
Fixed in 7.23.0-1+deb12u1
Upgrade
Upgrade debian/puppet-agent to a version that resolves this vulnerability.
Fixed in 8.10.0-5+deb13u1

Event History

Nov 3, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this vulnerability?

Any client holding a CA-signed Puppet agent certificate can submit a crafted report to execute code on the Puppet Server as its service user. If certificate autosigning lacks strong verification, an unauthenticated network attacker may be able to obtain a qualifying certificate first.

What access and attack path are required?

The attacker needs network access to submit a PUT request containing a report with a crafted rich-data type. Exploitation targets the Puppet Server report-processing code rather than the agent itself.

What can be done while patching is not immediately possible?

Ensure certificate autosigning performs strong verification, since weak autosigning can let unauthenticated attackers obtain the certificate needed for exploitation. Restrict access to the Puppet Server report submission interface to trusted, authenticated agent networks.

DEBIAN-CVE-2026-115731: Debian/puppet-agent vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What access and attack path are required?

What can be done while patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What access and attack path are required?

What can be done while patching is not immediately possible?