{"slug":"puppet-openvox-cve-2026-115731","title":"Puppet / OpenVox Server report-deserialization RCE (CVE-2026-115731)","shortName":"OpenVox","summary":"Report-processing deserialization RCE on OpenVox / Puppet Server (CVE-2026-115731, Perforce CNA CVSS 4.0 9.4). A client with a CA-signed agent certificate submits a crafted report; code runs as the puppet service user and can read the CA signing key. Weak autosigning can let an unauthenticated network attacker obtain that certificate. Related CVE-2026-115732 is a certname authorization bypass with no standalone report-deserialization shell path. Patched in openvox-server 9.2.0 / 8.18.0, openvox-agent 9.3.0 / 8.32.0, PE 2023.8.13 / 2025.12.1 / 2026.0.1, and Puppet Core 9.1.3 (affected range: no statement yet). Open Source Puppet has no fix on that line; migrate to OpenVox. Not in CISA KEV (catalog 2026.11.03, checked 4 Nov 2026). No known ITW as of 4 Nov 2026. GHSA-ffr6-rwpm-p5wq includes a vendor sample; this page links it only. Neodyme write-up (3 Nov 2026) is linked from research only.","isExample":false,"draft":false,"family":"puppet-openvox-cve-2026-115731","kind":"single-product","aliases":["CVE-2026-115731","CVE-2026-115732","GHSA-ffr6-rwpm-p5wq","GHSA-q4hm-33rc-572g","OpenVox Server RCE","Puppet Server report deserialization"],"publishedAt":"2026-11-04","updatedAt":"2026-11-04","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2026-115731","cvss":{"cve":"CVE-2026-115731","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","scorer":"cna","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","sourceDate":"2026-11-03","checkedDate":"2026-11-04","dateLabel":"CNA published","sourceLabel":"Perforce CNA (CVSS 4.0 9.4). NVD API 4 Nov 2026: Received, Secondary CNA metric; no NVD-produced Primary. NVD HTML detail page returned 403.","nvdPublishedDate":"2026-11-03"},"epss":{"cve":"CVE-2026-115731","score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115731","checkedDate":"2026-11-04"},"kev":{"cve":"CVE-2026-115731","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.03","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-04"},"addedDate":"2026-11-04"},"priority":{"label":"high"},"managementSummary":{"what":"OpenVox / Puppet Server report-processing deserialization can run code as the puppet service user (CVE-2026-115731, Perforce CNA CVSS 4.0 9.4). A CA-signed agent certificate is required; weak autosigning can make that step unauthenticated. Related CVE-2026-115732 is a certname bypass (CNA 9.0) with no standalone report-deserialization shell path. Not in CISA KEV (checked 4 Nov 2026). No known ITW as of 4 Nov 2026. A vendor sample is in the OpenVox GHSA.","action":"Upgrade OpenVox, Puppet Enterprise, or Puppet Core to a listed fixed build. Until then, disable or tightly restrict autosigning and limit network access to the server. After upgrade, review custom auth.conf rules. If compromise is suspected, treat the CA signing key as exposed and plan CA rotation."},"seenInTheWild":[{"metric":"third-party-stated","value":"No confirmed exploitation reported as of 4 Nov 2026","observer":"SecurityOnline","date":"2026-11-04","method":"SecurityOnline (4 Nov 2026) says no confirmed exploitation yet (no confirmed exploitation claimed). That is a 4 Nov check, not a first-seen exploitation day. Badge: No known ITW. Never a not-exploited mark.","sourceUrl":"https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/"}],"seenInTheWildLinks":[{"title":"PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)","url":"https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/","observer":"SecurityOnline","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-04","items":[{"text":"New catalog page for Puppet / OpenVox Server report-deserialization RCE (CVE-2026-115731) and related CVE-2026-115732.","headline":"New catalog page for Puppet OpenVox CVE-2026-115731","section":"overview","date":"2026-11-04","kind":"page"},{"text":"OpenVox published GHSA-ffr6-rwpm-p5wq on 3 Nov 2026 at 20:04 UTC for report-processing deserialization RCE. Perforce CNA CVE-2026-115731 (published 20:40 UTC) scores CVSS 4.0 9.4. Fixed builds: openvox-server 9.2.0 / 8.18.0, openvox-agent 9.3.0 / 8.32.0, openvoxdb 9.2.0 / 8.18.0 (companion), PE 2023.8.13 / 2025.12.1 / 2026.0.1, Puppet Core 9.1.3. Open Source Puppet has no fix on that line; migrate to OpenVox. Neodyme published Pulling the right strings for RCE on a Puppet (3 Nov 2026); this page links it only.","headline":"OpenVox and Perforce disclose report-deserialization RCE; patches are out","section":"fixed-versions","date":"2026-11-04","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","alsoSourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-115731"},{"text":"No in-the-wild use reported as of 4 Nov 2026. SecurityOnline (4 Nov 2026) says no confirmed exploitation yet. Badge: No known ITW. Never a not-exploited mark. GHSA-ffr6-rwpm-p5wq includes a vendor-included sample; this page links the advisory only. Not in CISA KEV (catalog 2026.11.03, released 2026-11-03T20:00:24Z, 1,767 entries, checked 4 Nov 2026).","headline":"No known ITW as of 4 Nov; GHSA sample public; not in KEV","section":"exploitation","date":"2026-11-04","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/"}]},"whatTheBugIs":"CVE-2026-115731 is report-processing deserialization on OpenVox / Puppet Server. An agent sends a JSON report after a run. In some cases an event can carry a serialized Ruby object. When the server converts that object, a crafted type can run code as the puppet service user. OpenVox GHSA-ffr6-rwpm-p5wq (published 3 Nov 2026, 20:04 UTC) names PUT /puppet/v3/report as the sink. This page does not republish the sample report or any payload.\n\nA CA-signed agent certificate is required. The advisory says that with autosign, which it calls common in enterprise deployments, an unauthenticated network attacker can request a certificate and then use this path. Default Puppet Server port is TCP 8140 (Neodyme, 3 Nov 2026). GHSA: code as puppet can read the CA signing key and mint certificates; that can enable command execution on other hosts if certain orchestration is configured.\n\nPerforce CNA published CVE-2026-115731 at 20:40 UTC on 3 Nov 2026 (reserved 23 Oct 2026). Score: CVSS 4.0 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). CWE-502 and CWE-94. Red Hat republishes CVSS 3.1 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) as a preliminary product score. FIRST EPSS had no row on 4 Nov 2026. NVD API (checked 4 Nov 2026): vulnStatus Received, published 2026-11-03T21:17:01.867, lastModified the same instant. Secondary CNA metric CVSS 4.0 9.4 from security@puppet.com. No NVD-produced Primary metric. The HTML detail page returned HTTP 403 when fetched.\n\nRelated CVE-2026-115732 (GHSA-q4hm-33rc-572g, published 3 Nov 2026 20:05 UTC; CNA 9.0) is a certname authorization bypass in trapperkeeper-authorization. A certificate name that extends an authorized hostname can be treated as that host. It has no standalone report-deserialization shell path. The Perforce CNA for 115732 says that in Puppet Enterprise this can reach certificate-authority administration and remote command execution on managed nodes. OpenVoxDB is listed on that advisory, not on the RCE GHSA. A third container-openvoxdb ALLOWLIST issue was disclosed the same day; it is not this CVE.\n\nFixed builds, from OpenVox and Perforce: openvox-server 9.2.0 / 8.18.0; openvox-agent 9.3.0 / 8.32.0; openvoxdb 9.2.0 / 8.18.0 (companion and container); PE 2023.8.13 / 2025.12.1 / 2026.0.1 (CNA: those PE releases bundle puppet-agent 8.22.2 or 9.1.3); Puppet Core 9.1.3 names the fix (affected range: no statement yet). Vox Pupuli (3 Nov 2026, updated 4 Nov): all known Puppet implementations are vulnerable; Open Source Puppet has no fix on that line; migrate to OpenVox. Credit: Alain (alain-neodyme) at Neodyme, coordinated with Vox Pupuli and Perforce. Neodyme write-up (3 Nov 2026): Pulling the right strings for RCE on a Puppet. This page links it only and does not copy payload, gadget, or step detail. Vox Pupuli and SecurityOnline both link that post.","attackPath":{"caption":"High-level only. Not a reproduction guide. No report body, type gadget, or enrollment steps.","steps":[{"id":"reach","label":"Reach the server","detail":"Network access to OpenVox / Puppet Server. Default listen port is TCP 8140 (Neodyme, 3 Nov 2026). GHSA: a CA-signed agent certificate, or autosign that issues one."},{"id":"app","label":"Report submitted","detail":"The agent report path is PUT /puppet/v3/report. Conceptual impact class only."},{"id":"unsafe","label":"Event object deserialized","detail":"GHSA: the server deserializes a crafted event type from the report. No type names or payloads here."},{"id":"exec","label":"Code as puppet","detail":"Code runs as the puppet service user on the server host or container."},{"id":"shell","label":"CA key and fleet","detail":"GHSA: code as puppet can read the CA signing key and mint certificates. Server access could enable command execution on other hosts if certain orchestration is configured."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-03","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 4 Nov 2026) against catalog 2026.11.03 (released 2026-11-03T20:00:24.8741Z, 1,767 entries). CVE-2026-115731 and CVE-2026-115732 are not listed."},"firstSeen":{"date":null,"source":"SecurityOnline (4 Nov 2026). OpenVox GHSA and Vox Pupuli blog (3 Nov 2026).","note":"No in-the-wild use reported as of 4 Nov 2026. SecurityOnline says no confirmed exploitation yet. The OpenVox GHSA and Vox Pupuli post do not report attacks. Badge: No known ITW. Never a not-exploited mark."},"vendorStatements":[{"vendor":"OpenVox / Vox Pupuli","date":"2026-11-03","statement":"Authenticated attackers with a OpenVox / Puppet client certificate can cause remote code execution on the OpenVox / Puppet server via a Ruby deserialize vulnerability.","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","retracted":false},{"vendor":"Perforce (CNA)","date":"2026-11-03","statement":"Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","retracted":false},{"vendor":"Red Hat","date":"2026-11-03","statement":"Until patched, avoid autosigning certificate requests without strong verification so untrusted clients cannot obtain a CA-signed agent certificate.","url":"https://access.redhat.com/security/cve/cve-2026-115731","retracted":false}]},"timeline":[{"date":"2026-10-23T11:46:21.022Z","event":"Perforce reserved CVE-2026-115731. Companion CVE-2026-115732 was reserved the same day at 11:46:46 UTC.","source":{"title":"CVE-2026-115731 (Perforce CNA)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","publisher":"Perforce / CVE.org"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-11-03","event":"Puppet Enterprise 2023.8.13, 2025.12.1, and 2026.0.1 launched. Perforce CNA later names these as the PE fixes for CVE-2026-115731 and CVE-2026-115732.","source":{"title":"Puppet Enterprise Version History","url":"https://www.puppet.com/releases/version-history","publisher":"Puppet by Perforce"},"kind":"patch","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03","event":"Puppet Core 9.1.3 notes say Released in November 2026 and name fixes for CVE-2026-115731 and CVE-2026-115732. Puppet Server 9.0.24.1 shipped with that Core build. The notes do not name a calendar day.","source":{"title":"Puppet Core 9.1.3","url":"https://help.puppet.com/core/current/content/puppetcore/PuppetReleaseNotes/release_notes_puppet_x-9-1-3.htm","publisher":"Puppet by Perforce"},"kind":"patch","addedDate":"2026-11-04"},{"date":"2026-11-03T20:04:27Z","event":"OpenVox published GHSA-ffr6-rwpm-p5wq at 20:04 UTC. Authenticated RCE via event deserialization. CVSS 4.0 9.4. Affected: OpenVox Server <= 9.1.0 and <= 8.17.0; OpenVox Agent <= 9.2.0 and <= 8.31.1. Patched: server 9.2.0 / 8.18.0; agent 9.3.0 / 8.32.0. Reporter: alain-neodyme. The body includes a vendor sample; this site links the advisory only.","source":{"title":"GHSA-ffr6-rwpm-p5wq","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","publisher":"OpenVox Project"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03T20:05:00Z","event":"OpenVox published GHSA-q4hm-33rc-572g at 20:05 UTC for the related certname authorization bypass (CVE-2026-115732). Affected: OpenVox Server and OpenVoxDB <= 9.1.0 and <= 8.17.0. Patched: 9.2.0 / 8.18.0. No standalone report-deserialization shell path.","source":{"title":"GHSA-q4hm-33rc-572g","url":"https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g","publisher":"OpenVox Project"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03T20:09:48Z","event":"Ben Ford posted the OpenVox coordinated disclosure to oss-security at 12:09:48 -0800. Named fixed packages: openvox-agent 9.3.0 / 8.32.0, openvox-server 9.2.0 / 8.18.0, openvoxdb 9.2.0 / 8.18.0. Said OSS Puppet will not receive security updates. CVE numbers were still pending GitHub review at that minute.","source":{"title":"OpenVox Server RCE and client impersonation vulnerabilities","url":"https://www.openwall.com/lists/oss-security/2026/11/03/14","publisher":"oss-security / Ben Ford"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-11-03T20:38:24.169Z","event":"Perforce CNA published CVE-2026-115732 (Certificate Name Authorization Bypass), CNA 9.0. PE affected ranges match the RCE CVE. The CNA says PE can reach CA administration and remote command execution on managed nodes through this bypass.","source":{"title":"CVE-2026-115732 (Perforce CNA)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115732","publisher":"Perforce / CVE.org"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-11-03T20:40:10.100Z","event":"Perforce CNA published CVE-2026-115731 (Report Deserialization Code Execution), CVSS 4.0 9.4. PE affected: 2023.8.0 before 2023.8.13, 2025.0.0 before 2025.12.1, 2026.0.0 before 2026.0.1. Default status for Puppet Enterprise is affected.","source":{"title":"CVE-2026-115731 (Perforce CNA)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","publisher":"Perforce / CVE.org"},"kind":"disclosure","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03","event":"Vox Pupuli published Critical CVE Updates. Last updated 4 Nov 2026. Upgrade immediately. Mitigations: restrict server network access; disable or tighten autosign; review custom auth.conf after upgrade. Coordinated date chosen so Puppet Enterprise could ship the same day.","source":{"title":"Critical CVE Updates in all known versions of Puppet and OpenVox","url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","publisher":"Vox Pupuli"},"kind":"vendor","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03","event":"Not in CISA KEV. Catalog 2026.11.03 released 2026-11-03T20:00:24.8741Z (1,767 entries). Rechecked 4 Nov 2026. CVE-2026-115731 is not listed.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-11-04","event":"SecurityOnline reported that the OpenVox GHSA includes a public sample and said no confirmed exploitation yet. This page uses No known ITW and does not use a not-exploited mark.","source":{"title":"Puppet Server RCE CVE-2026-115731 PoC","url":"https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/","publisher":"SecurityOnline"},"kind":"poc","addedDate":"2026-11-04"}],"openNotes":[{"title":"Perforce customer portal is login-walled","detail":"The CNA reference https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution did not render a public advisory body when opened on 4 Nov 2026. PE versions on this page come from the Perforce CNA record and puppet.com version history, not from that portal page.","sources":[{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","date":"2026-11-03","publisher":"Perforce / CVE.org"},{"url":"https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution","date":"2026-11-03","publisher":"Perforce"}]},{"title":"Companion CVE-2026-115732 score sources differ on GitHub API","detail":"Perforce CNA and the GHSA Related line score CVE-2026-115732 at CNA 9.0. The GitHub repository-advisory API returned CVSS 4.0 9.5 with privilegesRequired None. This page uses CNA 9.0 for the related CVE.","sources":[{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-115732","date":"2026-11-03","publisher":"Perforce / CVE.org"},{"url":"https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g","date":"2026-11-03","publisher":"OpenVox Project"}]}],"defenderActions":[{"title":"Upgrade OpenVox, Puppet Enterprise, or Puppet Core","detail":"Upgrade is the only full fix. OpenVox: server 9.2.0 or 8.18.0; agent 9.3.0 or 8.32.0; openvoxdb 9.2.0 or 8.18.0. PE: 2023.8.13, 2025.12.1, or 2026.0.1, then restart puppet server so the fixed code is loaded (Perforce CNA). Puppet Core: 9.1.3 names the fix (affected range: no statement yet). Open Source Puppet: no fix on that line; migrate to OpenVox. Vox Pupuli: all known Puppet implementations are vulnerable.","priority":"now","links":[{"label":"Vox Pupuli critical CVE updates","href":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/"},{"label":"GHSA-ffr6-rwpm-p5wq","href":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq"},{"label":"Perforce CNA CVE-2026-115731","href":"https://cveawg.mitre.org/api/cve/CVE-2026-115731"}]},{"title":"Disable or tightly restrict autosigning until patched","detail":"GHSA: with autosign, this path can become an unauthenticated chain because a certificate can be requested. Vox Pupuli and Red Hat: disable or tighten autosign; do not use naive autosign=true. This narrows who can obtain a CA-signed agent certificate. It does not close the bug for a holder of an existing signed cert.","priority":"now","links":[{"label":"Vox Pupuli mitigations","href":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/"},{"label":"Red Hat CVE-2026-115731","href":"https://access.redhat.com/security/cve/cve-2026-115731"}]},{"title":"Limit network access to the server","detail":"Vox Pupuli: both OpenVox Server issues require network access and a valid signed certificate. Allow the server only from the networks that need it. Default Puppet Server port is TCP 8140 (Neodyme, 3 Nov 2026). Confirm the listen port your install uses. This reduces exposure. It does not replace the upgrade.","priority":"now","links":[{"label":"Vox Pupuli mitigations","href":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/"},{"label":"Neodyme write-up (port 8140)","href":"https://neodyme.io/en/blog/puppet_rce/"}]},{"title":"Review custom auth.conf rules after upgrade","detail":"Vox Pupuli: custom authentication rules may have depended on the old matching and may need updates. Puppet PE upgrade cautions for 2023.8.13, 2025.12.1, and 2026.0.1: hostname rules match the exact name; wildcard rules no longer match the bare domain.","priority":"soon","links":[{"label":"Vox Pupuli post-upgrade note","href":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/"},{"label":"PE upgrade cautions","href":"https://help.puppet.com/pe/current/topics/upgrade_cautions.htm"}]},{"title":"If compromise is suspected, treat the CA key as exposed","detail":"GHSA: code execution as puppet gives access to the CA signing key. Plan CA rotation. Hunt Detection pointers before you overwrite logs. No sourced in-the-wild persistence list exists.","priority":"now","links":[{"label":"GHSA-ffr6-rwpm-p5wq","href":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq"}]}],"detection":[{"title":"Unexpected PUT /puppet/v3/report submissions","detail":"Hunt Puppet Server access logs for PUT /puppet/v3/report from unexpected sources or from certnames that do not match the managed inventory. GHSA-ffr6-rwpm-p5wq names that path. A request is reachability plus a report, not proof of code execution. No public Nuclei, Sigma, or IDS rule for CVE-2026-115731 was found as of 4 Nov 2026. Do not send crafted reports.","logSource":"Puppet Server HTTP access logs","kind":"generic","group":"web-proxy","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03"},{"title":"Newly autosigned certificates from unknown hosts","detail":"Review Puppet CA logs and the inventory of signed certificates for autosigned certs issued to unknown or unexpected certnames. GHSA: autosign can turn this into an unauthenticated chain. Presence of a new cert is a lead, not proof of this CVE.","logSource":"Puppet CA logs and signed-certificate inventory","kind":"generic","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03"},{"title":"Unexpected children of the puppetserver JVM as puppet","detail":"Review process telemetry on the Puppet / OpenVox server for unexpected child processes of the puppetserver JVM running as the puppet user. GHSA: successful use runs code as puppet. A child process is a lead, not proof of this CVE. No vendor process signature was published in the sources we opened.","logSource":"Host or container EDR / process-creation logs for puppetserver as user puppet","kind":"generic","group":"edr","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03"}],"detectionRules":[{"id":"v2s-sigma-puppet-openvox-cve-2026-115731-report","title":"Puppet Server report PUT hunt","language":"sigma","query":"title: Puppet Server report PUT hunt\nid: 7c2a9e14-6b81-4d3f-a5c0-2e8f1b4d9a70\nstatus: experimental\ndescription: Detects HTTP PUT requests to the Puppet / OpenVox report path named in GHSA-ffr6-rwpm-p5wq for CVE-2026-115731. Path hunt only. Not a payload detector.\nreferences:\n    - https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq\nauthor: vuln2shell\ndate: 2026-11-04\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: 'PUT'\n        cs-uri-stem|contains: '/puppet/v3/report'\n    condition: selection\nfalsepositives:\n    - Legitimate agent report submissions after an enforcement run\nlevel: informational","logSource":"Puppet Server HTTP access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. A request is not proof of compromise. Tune field names to your shipper. No public Nuclei, Sigma, or IDS rule for this CVE was found as of 4 Nov 2026.","tested":"untested"},{"id":"v2s-spl-puppet-openvox-cve-2026-115731-report","title":"Puppet Server report PUT hunt (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access)\nmethod=PUT \"/puppet/v3/report\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src values(ssl_client_s_dn) as certname by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Puppet Server HTTP access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Tune sourcetype and certificate-name fields to your shipper. Compare certname to your inventory.","tested":"untested"},{"id":"v2s-kql-puppet-openvox-cve-2026-115731-report","title":"Puppet Server report PUT hunt (KQL)","language":"kql","query":"PuppetServerAccess_CL\n| where TimeGenerated > ago(14d)\n| where HttpMethod == \"PUT\" and UriStem has \"/puppet/v3/report\"\n| summarize count() , min(TimeGenerated), max(TimeGenerated) by Computer, SrcIP, UriStem, Status\n| order by count_ desc","logSource":"Puppet Server Jetty access logs shipped to a custom Microsoft Sentinel table","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Puppet Server writes Jetty access logs, not IIS. Map PuppetServerAccess_CL and these field names to your ingest of those logs.","tested":"untested"},{"id":"v2s-esql-puppet-openvox-cve-2026-115731-report","title":"Puppet Server report PUT hunt (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE http.request.method == \"PUT\" AND url.path LIKE \"*/puppet/v3/report*\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip, url.path, http.response.status_code","logSource":"Puppet Server access logs shipped to Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Index and field names vary by ingest pipeline.","tested":"untested"}],"detectionLinks":[{"title":"GHSA-ffr6-rwpm-p5wq (CVE-2026-115731)","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","author":"OpenVox Project / alain-neodyme","date":"2026-11-03","note":"Names PUT /puppet/v3/report. This site does not copy the attached sample."}],"retrohunt":{"summary":"If an OpenVox or Puppet Server was reachable from 3 Nov 2026, hunt access logs for PUT /puppet/v3/report from unexpected certnames, CA logs for new autosigned certificates, and process telemetry for unexpected children of the puppetserver JVM as puppet.","lookback":{"from":"2026-11-03","basis":"public-poc","rationale":"OpenVox published GHSA-ffr6-rwpm-p5wq, with a vendor-included sample in the body, on 3 Nov 2026 at 20:04:27 UTC. Hunt from that day. No earlier public sample was found.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]},"logSources":[{"name":"Puppet Server HTTP access logs","why":"GHSA-ffr6-rwpm-p5wq names PUT /puppet/v3/report.","required":true},{"name":"Puppet CA logs and signed-certificate inventory","why":"Autosigned certificates from unknown hosts are the unauthenticated-chain lead.","required":true},{"name":"Host or container process telemetry for puppetserver as user puppet","why":"Successful use runs code as the puppet service user.","required":false}],"steps":[{"title":"List PUT /puppet/v3/report since 3 Nov 2026","detail":"Search Puppet Server access logs for PUT /puppet/v3/report from 3 Nov 2026. Compare source and certname to the managed inventory. A request is not proof of compromise. Do not send crafted reports.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]},{"title":"Review autosigned certificates issued from 3 Nov 2026","detail":"Inspect CA logs and the signed-certificate inventory for certs issued to unknown hosts. Presence is a lead, not proof of this CVE.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]},{"title":"Review unexpected puppetserver child processes","detail":"Inspect process telemetry for children of the puppetserver JVM running as puppet. Researcher hunting pointer from the advisory impact, not an in-the-wild observation.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]}],"queries":[{"id":"v2s-spl-puppet-openvox-cve-2026-115731-retrohunt","title":"Puppet Server report PUT since 3 Nov 2026","language":"spl","query":"index=* method=PUT \"/puppet/v3/report\" earliest=11/03/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Puppet Server HTTP access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback window from the 3 Nov 2026 GHSA. Tune sourcetype to your shipper.","tested":"untested","timeRange":"From 3 Nov 2026 (GHSA-ffr6-rwpm-p5wq public sample) through the last patch window"}],"artefacts":[{"kind":"web-log","value":"PUT /puppet/v3/report","detail":"GHSA-ffr6-rwpm-p5wq access path. A request is reachability plus a report, not proof of code execution.","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03"},{"kind":"account","value":"Newly autosigned certificate for an unknown certname","detail":"GHSA: autosign can issue a CA-signed agent certificate to an unauthenticated requester. Presence is a lead.","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03"},{"kind":"process","value":"Unexpected child of the puppetserver JVM as user puppet","detail":"GHSA: successful use runs code as the puppet service user. Hunting pointer, not an in-the-wild observation.","sourceUrl":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","sourceDate":"2026-11-03"}],"iocNote":"No published attacker IPs, hashes, or user-agents from a source we can copy here as of 4 Nov 2026. Do not invent IPs or hashes.","hitMeaning":[{"level":"attempt","detail":"PUT /puppet/v3/report from an untrusted network or unexpected certname, with no new autosigned cert and no unexpected puppetserver child process."},{"level":"likely-compromise","detail":"Those requests plus a newly autosigned certificate for an unknown host, or an unexpected child of the puppetserver JVM as puppet, on a server below the listed fixed builds that was reachable from 3 Nov 2026."},{"level":"compromise","detail":"Evidence that attacker-controlled code ran as puppet, or that the CA signing key was read or used to mint unexpected certificates. No sourced in-the-wild procedure was published in the sources we opened. Independent validation: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Upgrade and restrict autosign plus network access","detail":"Vox Pupuli names the OpenVox package versions. Perforce CNA names the PE releases. Disable or tighten autosign until patched.","links":[{"label":"Vox Pupuli critical CVE updates","href":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/"},{"label":"GHSA-ffr6-rwpm-p5wq","href":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq"}]},{"title":"Preserve access logs, CA inventory, and process audit before upgrade","detail":"Keep copies of Puppet Server access logs, CA logs, the signed-certificate inventory, and process telemetry from 3 Nov 2026 onward before restore or upgrade.","links":[{"label":"GHSA-ffr6-rwpm-p5wq","href":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq"}]}],"limits":["No in-the-wild use reported as of 4 Nov 2026.","No published attacker IPs are copied here.","A PUT /puppet/v3/report is not proof of compromise.","First calendar day of successful compromise: not verified.","No public Nuclei, Sigma, or IDS rule was found as of 4 Nov 2026."],"sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"},{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}],"updatedAt":"2026-11-04"},"amIAffected":{"summary":"OpenVox Server <= 9.1.0 and <= 8.17.0, OpenVox Agent <= 9.2.0 and <= 8.31.1, PE before 2023.8.13 / 2025.12.1 / 2026.0.1, Puppet Core (9.1.3 names the fix; affected range: no statement yet), and Open Source Puppet (no fix on that line; migrate to OpenVox). Preconditions: a CA-signed agent certificate, or autosigning that issues one, plus network access to the server. Default Puppet Server port is TCP 8140 (Neodyme, 3 Nov 2026).","checks":[{"id":"v2s-aia-puppet-openvox-cve-2026-115731-version-1","kind":"version","title":"Record the installed server and agent versions","detail":"On each server and agent, run the product's own version command and compare it to the advisory ranges. Do not send crafted reports.","command":"puppet --version; puppetserver --version","affectedMeans":"OpenVox Server is 9.1.0 or earlier on 9.x, or 8.17.0 or earlier on 8.x; OpenVox Agent is 9.2.0 or earlier on 9.x, or 8.31.1 or earlier on 8.x; PE is below 2023.8.13 / 2025.12.1 / 2026.0.1 on those lines; Puppet Core is not the 9.1.3 build that names the fix (affected range: no statement yet); or the host still runs Open Source Puppet.","fixedMeans":"OpenVox Server is 9.2.0 / 8.18.0 or later, agent is 9.3.0 / 8.32.0 or later, PE is 2023.8.13 / 2025.12.1 / 2026.0.1 or later, or Puppet Core is the 9.1.3 build that names the fix.","notes":"Inventory only. Package managers may report openvox-server / openvox-agent / pe-puppetserver instead of these commands.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","date":"2026-11-03","publisher":"Perforce / CVE.org"}]},{"id":"v2s-aia-puppet-openvox-cve-2026-115731-package-2","kind":"package","title":"Record the OpenVox or PE packages","detail":"Compare installed package versions to the fixed builds. Use the same package manager the host uses.","command":"rpm -q openvox-server openvox-agent openvoxdb || dpkg-query -W openvox-server openvox-agent openvoxdb","affectedMeans":"openvox-server is 9.1.0 or earlier / 8.17.0 or earlier, openvox-agent is 9.2.0 or earlier / 8.31.1 or earlier, or the host still runs Open Source Puppet packages with no OpenVox or PE upgrade.","fixedMeans":"openvox-server is 9.2.0 / 8.18.0 or later and openvox-agent is 9.3.0 / 8.32.0 or later, or the host runs a listed PE or Puppet Core fixed build.","notes":"PE and Core packages use different names. Record pe-puppetserver or the Core package list the same way. OpenVoxDB is listed for the companion CVE, not the RCE GHSA.","sources":[{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}]},{"id":"v2s-aia-puppet-openvox-cve-2026-115731-config-3","kind":"config","title":"Record whether autosign is on, and how it decides","detail":"GHSA: autosign can turn this into an unauthenticated chain. Record the autosign setting. Do not request a certificate as a test.","command":"puppet config print autosign --section server","affectedMeans":"The server is below a listed fixed build and autosign is true, or a policy script / allowlist issues certificates without strong verification.","fixedMeans":"The server is on a listed fixed build, or autosign is off / restricted to a reviewed policy (workaround only).","notes":"Autosign is a precondition, not a fix. A holder of an existing signed cert remains in scope.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"},{"url":"https://access.redhat.com/security/cve/cve-2026-115731","date":"2026-11-03","publisher":"Red Hat"}]},{"id":"v2s-aia-puppet-openvox-cve-2026-115731-config-4","kind":"config","title":"Record whether untrusted networks can reach the server","detail":"Vox Pupuli: both server issues require network access. Record the listen address and which networks can complete a TCP connection to the server port. Default Puppet Server port is TCP 8140 (Neodyme, 3 Nov 2026). Do not send application requests.","command":"On each server, record the listen address from puppetserver.conf or the equivalent PE / OpenVox setting, and whether untrusted networks can complete a TCP connection to TCP 8140 (Neodyme default, 3 Nov 2026) or the port your install actually uses.","affectedMeans":"The server is below a listed fixed build and untrusted networks can reach the listen port.","fixedMeans":"The server is on a listed fixed build, or untrusted networks cannot complete a TCP connection to the listen port (workaround only).","notes":"Default Puppet Server port is TCP 8140 (Neodyme, 3 Nov 2026). Record whether your install still uses that default.","sources":[{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"},{"url":"https://neodyme.io/en/blog/puppet_rce/","date":"2026-11-03","publisher":"Alain / Neodyme"}]}],"limits":["No sourced Shodan or Censys fingerprint for this CVE. Do not invent one.","No public internet-host count was published.","Local version commands do not prove a remote container is patched.","Autosign off is not a fix while existing signed certificates remain."],"sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"},{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","date":"2026-11-03","publisher":"Perforce / CVE.org"},{"url":"https://neodyme.io/en/blog/puppet_rce/","date":"2026-11-03","publisher":"Alain / Neodyme"}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"mitigations":{"summary":"Vox Pupuli (3 Nov 2026, updated 4 Nov) and Red Hat document compensating controls until a fixed build: restrict server network access, and disable or tighten autosign. After upgrade, review custom auth.conf rules. None of those replace the upgrade.","items":[{"title":"Disable or tightly restrict autosigning","detail":"Vox Pupuli: disable or tighten access to autosign. Red Hat: until patched, avoid autosigning certificate requests without strong verification so untrusted clients cannot obtain a CA-signed agent certificate. Do not leave autosign=true.","limits":"Not a software fix. A holder of an existing signed certificate remains in scope. Still upgrade.","verify":"puppet config print autosign --section server is false, or the policy / allowlist is restricted to reviewed hosts. Confirm in puppet.conf, then re-check after the next change window. Do not request a certificate as a test.","source":{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}},{"title":"Limit network access to the server","detail":"Vox Pupuli: ensure that the server is only reachable from the network segments which require access. Both OpenVox Server issues require network access and a valid signed certificate. Default Puppet Server port is TCP 8140 (Neodyme, 3 Nov 2026).","limits":"Not a software fix. Internal servers remain in scope if an attacker can reach the port and holds a signed cert. Still upgrade.","verify":"Untrusted networks can no longer complete a TCP connection to TCP 8140 (Neodyme default, 3 Nov 2026) or the listen port your install uses. Confirm in the edge firewall or host ACL, then re-check after the next change window. Do not send application requests.","source":{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}},{"title":"Review custom auth.conf rules after upgrade","detail":"Vox Pupuli: if you added custom authentication rules, validate them after upgrade. Custom rules may have depended on buggy behaviour. PE upgrade cautions for 2023.8.13, 2025.12.1, and 2026.0.1: hostname rules match the exact name; wildcard rules no longer match the bare domain.","limits":"This is a post-upgrade check, not a workaround for the RCE. It addresses the related certname-matching change.","verify":"Custom auth.conf rules still grant only the intended certnames. Confirm against a known agent and a name that previously matched by prefix. Re-check after the next change window.","source":{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"response":{"summary":"Restrict server network access, disable or tighten autosign, and upgrade to a listed fixed build. If a server below those builds was reachable, preserve access logs, CA inventory, and process telemetry, then treat the CA signing key as exposed. No sourced in-the-wild persistence list exists.","containment":[{"title":"Remove untrusted networks from the server listen port","detail":"Vox Pupuli: allow the server only from the networks that need it.","sources":[{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}]},{"title":"Disable or tighten autosign","detail":"Red Hat and Vox Pupuli: stop autosigning without strong verification. This does not close the bug for a caller who already holds a signed certificate.","sources":[{"url":"https://access.redhat.com/security/cve/cve-2026-115731","date":"2026-11-03","publisher":"Red Hat"},{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"}]},{"title":"Upgrade to a listed fixed build","detail":"OpenVox server 9.2.0 / 8.18.0, agent 9.3.0 / 8.32.0, PE 2023.8.13 / 2025.12.1 / 2026.0.1, or Puppet Core 9.1.3. An upgrade does not replace log and CA review if the host was reachable while vulnerable.","sources":[{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","date":"2026-11-03","publisher":"Perforce / CVE.org"}]}],"rotate":[{"item":"Puppet / OpenVox CA signing key and issued certificates","reason":"GHSA-ffr6-rwpm-p5wq: code execution as puppet gives access to the CA signing key and can be used to sign client and server certificates.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]},{"item":"Secrets in catalogs, Hiera, and the server environment","reason":"GHSA: server access could enable command execution on other hosts if certain orchestration is configured, and the CA key can mint certs. Related CVE-2026-115732 can expose catalog data from impersonated nodes. Rotate secrets the server or catalogs could hold if compromise is suspected.","generic":true,"sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"},{"url":"https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g","date":"2026-11-03","publisher":"OpenVox Project"}]}],"evidence":[{"title":"Installed OpenVox, PE, or Core version from before the upgrade","detail":"Preserve puppet --version, puppetserver --version, and package-manager output so you can show whether the host was below a listed fixed build while reachable.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]},{"title":"Access logs for PUT /puppet/v3/report from 3 Nov 2026","detail":"Keep Puppet Server access logs that name PUT /puppet/v3/report, including source and certname, from 3 Nov 2026.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]},{"title":"CA inventory and process telemetry","detail":"Keep CA logs, the signed-certificate inventory, and host or container process audit for children of the puppetserver JVM as puppet from 3 Nov 2026 onward, before restore or upgrade.","sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"}]}],"limits":["No sourced in-the-wild persistence list exists.","A PUT /puppet/v3/report is not proof of compromise.","No in-the-wild use reported as of 4 Nov 2026. Not in CISA KEV (checked 4 Nov 2026)."],"sources":[{"url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","publisher":"OpenVox Project"},{"url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","publisher":"Vox Pupuli"},{"url":"https://access.redhat.com/security/cve/cve-2026-115731","date":"2026-11-03","publisher":"Red Hat"}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"bulletins":[{"vendor":"OpenVox / GitHub","title":"GHSA-ffr6-rwpm-p5wq (CVE-2026-115731)","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","cve":"CVE-2026-115731"},{"vendor":"OpenVox / GitHub","title":"GHSA-q4hm-33rc-572g (CVE-2026-115732)","url":"https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g","date":"2026-11-03","cve":"CVE-2026-115732"},{"vendor":"Vox Pupuli","title":"Critical CVE Updates in all known versions of Puppet and OpenVox","url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","cve":"CVE-2026-115731"},{"vendor":"Puppet by Perforce","title":"Puppet Core 9.1.3","url":"https://help.puppet.com/core/current/content/puppetcore/PuppetReleaseNotes/release_notes_puppet_x-9-1-3.htm","date":"2026-11-03","cve":"CVE-2026-115731"}],"coverage":[{"title":"GHSA-ffr6-rwpm-p5wq","publisher":"OpenVox Project","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"GHSA-q4hm-33rc-572g","publisher":"OpenVox Project","url":"https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"Critical CVE Updates in all known versions of Puppet and OpenVox","publisher":"Vox Pupuli","url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"OpenVox Server RCE and client impersonation vulnerabilities","publisher":"oss-security","url":"https://www.openwall.com/lists/oss-security/2026/11/03/14","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"CVE-2026-115731 (Perforce CNA)","publisher":"Perforce / CVE.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-115731","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"Puppet Core 9.1.3","publisher":"Puppet by Perforce","url":"https://help.puppet.com/core/current/content/puppetcore/PuppetReleaseNotes/release_notes_puppet_x-9-1-3.htm","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"Puppet Server 9.0.24.1 release notes","publisher":"Puppet by Perforce","url":"https://help.puppet.com/core/current/Content/PuppetCore/server/release_notes.htm","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"CVE-2026-115731","publisher":"Red Hat","url":"https://access.redhat.com/security/cve/cve-2026-115731","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"NVD CVE-2026-115731","publisher":"NIST NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115731","date":"2026-11-03","type":"government","addedDate":"2026-11-04"},{"title":"Pulling the right strings for RCE on a Puppet","publisher":"Alain / Neodyme","url":"https://neodyme.io/en/blog/puppet_rce/","date":"2026-11-03","type":"research","addedDate":"2026-11-04"},{"title":"CISA Known Exploited Vulnerabilities catalog","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-03","type":"government","addedDate":"2026-11-04"},{"title":"PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)","publisher":"SecurityOnline","url":"https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/","date":"2026-11-04","type":"news","addedDate":"2026-11-04"}],"posts":[],"research":[{"title":"Pulling the right strings for RCE on a Puppet","url":"https://neodyme.io/en/blog/puppet_rce/","authors":"Alain (Neodyme)","date":"2026-11-03"},{"title":"GHSA-ffr6-rwpm-p5wq (CVE-2026-115731)","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","authors":"alain-neodyme (reporter); OpenVox Project / binford2k","date":"2026-11-03T20:04:27Z"},{"title":"GHSA-q4hm-33rc-572g (CVE-2026-115732)","url":"https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g","authors":"alain-neodyme (reporter); OpenVox Project / binford2k","date":"2026-11-03T20:05:00Z"}],"impact":{"kind":"single-product","product":"OpenVox / Puppet Server","versions":[{"version":"OpenVox Server <= 9.1.0 and <= 8.17.0; CA-signed agent cert, or autosign","status":"affected","versions":"9.2.0 / 8.18.0","vendorStatement":{"date":"2026-11-03","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","quote":"Authenticated attackers with a OpenVox / Puppet client certificate can cause remote code execution on the OpenVox / Puppet server via a Ruby deserialize vulnerability."},"addedDate":"2026-11-04"},{"version":"OpenVox Agent <= 9.2.0 and <= 8.31.1; shared report/event code listed by the RCE GHSA","status":"affected","versions":"9.3.0 / 8.32.0","vendorStatement":{"date":"2026-11-03","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","quote":"Authenticated attackers with a OpenVox / Puppet client certificate can cause remote code execution on the OpenVox / Puppet server via a Ruby deserialize vulnerability."},"addedDate":"2026-11-04"},{"version":"OpenVoxDB (no RCE statement; companion CVE-2026-115732 lists <= 9.1.0 and <= 8.17.0)","status":"no-statement-yet","addedDate":"2026-11-04"},{"version":"Puppet Enterprise 2023.8.0 before 2023.8.13; CA-signed agent cert, or autosign","status":"affected","versions":"2023.8.13","vendorStatement":{"date":"2026-11-03","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","quote":"Upgrade to a release that bundles puppet-agent 8.22.2 or 9.1.3 (Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1) and restart puppet server so the fixed code is loaded."},"addedDate":"2026-11-04"},{"version":"Puppet Enterprise 2025.0.0 before 2025.12.1; CA-signed agent cert, or autosign","status":"affected","versions":"2025.12.1","vendorStatement":{"date":"2026-11-03","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","quote":"Upgrade to a release that bundles puppet-agent 8.22.2 or 9.1.3 (Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1) and restart puppet server so the fixed code is loaded."},"addedDate":"2026-11-04"},{"version":"Puppet Enterprise 2026.0.0 before 2026.0.1; CA-signed agent cert, or autosign","status":"affected","versions":"2026.0.1","vendorStatement":{"date":"2026-11-03","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","quote":"Upgrade to a release that bundles puppet-agent 8.22.2 or 9.1.3 (Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1) and restart puppet server so the fixed code is loaded."},"addedDate":"2026-11-04"},{"version":"Puppet Enterprise (other lines; CNA default is affected; no named fix)","status":"affected","vendorStatement":{"date":"2026-11-03","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115731","quote":"Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request."},"addedDate":"2026-11-04"},{"version":"Open Source Puppet; CA-signed agent cert, or autosign. No fix on this line; migrate to OpenVox. Neodyme (3 Nov 2026) says the path also works on open-source 6.24.0 (link only).","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-11-03","url":"https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/","quote":"All known Puppet implementations are vulnerable to the CVEs fixed in today's releases."},"addedDate":"2026-11-04"},{"version":"Puppet Core (affected range: no statement yet; 9.1.3 names the fix); CA-signed agent cert, or autosign","status":"affected","versions":"9.1.3","vendorStatement":{"date":"2026-11-03","url":"https://help.puppet.com/core/current/content/puppetcore/PuppetReleaseNotes/release_notes_puppet_x-9-1-3.htm","quote":"Fixed CVE-2026-115731, a vulnerability that could allow arbitrary code execution on the Puppet Server host."},"addedDate":"2026-11-04"}]},"pocs":[{"title":"Vendor-included sample in GHSA-ffr6-rwpm-p5wq (for defenders)","url":"https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq","source":"Neodyme (alain-neodyme); coordinated with Vox Pupuli and Perforce","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-03","notes":"OpenVox GHSA-ffr6-rwpm-p5wq (published 3 Nov 2026 20:04:27 UTC) includes a vendor-included sample in the advisory body. Credit: Alain (alain-neodyme) at Neodyme, coordinated with Vox Pupuli and Perforce. Status unverified as of 4 Nov 2026 (GHSA-ffr6-rwpm-p5wq, fetched 4 Nov 2026). That is a vendor-included sample, not a vuln2shell validation. Index link only. This site does not copy exploit code, payloads, or usage steps.","addedDate":"2026-11-04"}],"pocEmptyState":"Vendor-included sample is indexed by linking GHSA-ffr6-rwpm-p5wq only. Status unverified. Independent validation: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/puppet-openvox-cve-2026-115731","json":"https://vuln2shell.com/vulns/puppet-openvox-cve-2026-115731.json","iocsCsv":"https://vuln2shell.com/vulns/puppet-openvox-cve-2026-115731/iocs.csv","stix":"https://vuln2shell.com/vulns/puppet-openvox-cve-2026-115731/stix.json","badges":{"patch":"Patched","itw":"No known ITW","poc":"Public PoC (unverified RCE)"}}}