CVE-2026-115731 Report Deserialization Code Execution
CriticalCVSS 9.4
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/openvox-server(Red Hat:satellite:6.16::el8) | < 8.18.0-1.el8sat | 8.18.0-1.el8sat |
| redhat/python-pyyaml(Red Hat:satellite:6.16::el8) | < 6.0.1-1.el8pc | 6.0.1-1.el8pc |
| redhat/openvox-server(Red Hat:satellite_capsule:6.16::el8) | < 8.18.0-1.el8sat | 8.18.0-1.el8sat |
| redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el8) | < 6.0.1-1.el8pc | 6.0.1-1.el8pc |
| redhat/openvox-server(Red Hat:satellite:6.16::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/python-pyyaml(Red Hat:satellite:6.16::el9) | < 6.0.1-1.el9pc | 6.0.1-1.el9pc |
| redhat/openvox-server(Red Hat:satellite_capsule:6.16::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el9) | < 6.0.1-1.el9pc | 6.0.1-1.el9pc |
| redhat/openvox-agent(Red Hat:satellite:6.17::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite:6.17::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.17::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite_capsule:6.17::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite:6.19::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite_capsule:6.19::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-agent(Red Hat:rhel_satellite_openvox:6::el10) | < 8.32.0-1.el10sat | 8.32.0-1.el10sat |
| redhat/openvox-agent(Red Hat:rhel_satellite_openvox:6::el7) | < 8.32.0-1.el7sat | 8.32.0-1.el7sat |
| redhat/openvox-agent(Red Hat:rhel_satellite_openvox:6::el8) | < 8.32.0-1.el8sat | 8.32.0-1.el8sat |
| redhat/openvox-agent(Red Hat:rhel_satellite_openvox:6::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/puppet-agent(Red Hat:satellite:6) | All versions | No fix listed |
| redhat/puppetserver(Red Hat:satellite:6) | All versions | No fix listed |
| redhat/openvox-agent(Red Hat:rhel_satellite_client:6::el7) | All versions | No fix listed |
| redhat/puppet-agent(Red Hat:rhel_satellite_client:6::el7) | All versions | No fix listed |
| Perforce Puppet Enterprise | >= 2023.8.0, < 2023.8.13 | 2023.8.13 |
| Perforce Puppet Enterprise | >= 2025.0.0, < 2025.12.1 | 2025.12.1 |
| Perforce Puppet Enterprise | >= 2026.0.0, < 2026.0.1 | 2026.0.1 |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/puppet-agent(Debian:12) | < 7.23.0-1+deb12u1 | 7.23.0-1+deb12u1 |
| debian/puppet-agent(Debian:12) | = 7.23.0-1 | No fix listed |
| debian/puppet-agent(Debian:13) | < 8.10.0-5+deb13u1 | 8.10.0-5+deb13u1 |
| debian/puppet-agent(Debian:13) | = 8.10.0-5 | No fix listed |
| ubuntu/puppet(Ubuntu:22.04) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:95655 patch vendor-advisory
- RHSA-2026:95656 patch vendor-advisory
- RHSA-2026:95652 patch vendor-advisory
- RHSA-2026:95653 patch vendor-advisory
- Red Hat Bugzilla 2566451 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com
- portal.perforce.com
- voxpupuli.org
- www.openwall.com
- Debian Security Tracker CVE-2026-115731 vendor-advisory
- Ubuntu CVE tracker vendor-advisory