CVE-2026-115732 Certificate Name Authorization Bypass
CriticalCVSS 9.0
EPSS 0.75%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/openvox-server(Red Hat:satellite:6.16::el8) | < 8.18.0-1.el8sat | 8.18.0-1.el8sat |
| redhat/python-pyyaml(Red Hat:satellite:6.16::el8) | < 6.0.1-1.el8pc | 6.0.1-1.el8pc |
| redhat/openvox-server(Red Hat:satellite_capsule:6.16::el8) | < 8.18.0-1.el8sat | 8.18.0-1.el8sat |
| redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el8) | < 6.0.1-1.el8pc | 6.0.1-1.el8pc |
| redhat/openvox-server(Red Hat:satellite:6.16::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/python-pyyaml(Red Hat:satellite:6.16::el9) | < 6.0.1-1.el9pc | 6.0.1-1.el9pc |
| redhat/openvox-server(Red Hat:satellite_capsule:6.16::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el9) | < 6.0.1-1.el9pc | 6.0.1-1.el9pc |
| redhat/openvox-agent(Red Hat:satellite:6.17::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite:6.17::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.17::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite_capsule:6.17::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite:6.19::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/openvox-server(Red Hat:satellite_capsule:6.19::el9) | < 8.18.0-1.el9sat | 8.18.0-1.el9sat |
| redhat/puppetserver(Red Hat:satellite:6) | All versions | No fix listed |
| Perforce Puppet Enterprise | >= 2023.8.0, < 2023.8.13 | 2023.8.13 |
| Perforce Puppet Enterprise | >= 2025.0.0, < 2025.12.1 | 2025.12.1 |
| Perforce Puppet Enterprise | >= 2026.0.0, < 2026.0.1 | 2026.0.1 |
| debian/trapperkeeper-authorization-clojure(Debian:12) | < 1.0.0-4+deb12u1 | 1.0.0-4+deb12u1 |
| debian/trapperkeeper-authorization-clojure(Debian:12) | = 1.0.0-4 | No fix listed |
| debian/trapperkeeper-authorization-clojure(Debian:13) | < 2.0.1-2+deb13u1 | 2.0.1-2+deb13u1 |
| debian/trapperkeeper-authorization-clojure(Debian:13) | = 2.0.1-2 | No fix listed |
| debian/trapperkeeper-authorization-clojure(Debian:14) | < 2.5.0-1 | 2.5.0-1 |
| debian/trapperkeeper-authorization-clojure(Debian:14) | = 2.0.1-2 | No fix listed |
| debian/trapperkeeper-authorization-clojure(Debian:14) | = 2.4.1-1 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/puppetserver(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/puppetserver(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/puppetserver(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:95655 patch vendor-advisory
- RHSA-2026:95656 patch vendor-advisory
- RHSA-2026:95652 patch vendor-advisory
- Red Hat Bugzilla 2566291 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com
- portal.perforce.com
- voxpupuli.org
- www.openwall.com
- security-tracker.debian.org vendor-advisory
- Ubuntu CVE tracker vendor-advisory