# CVE-2026-115732: Puppet Server certificate-name authorization bypass

Source: https://junglewise.ai/threats/cve-2026-115732-incorrect-authorization-in-the-certificate-name-matching-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-115732 · Severity: info · Published 2026-11-03

Puppet Server's authorization system, built on trapperkeeper-authorization, incorrectly validates certificate names, allowing an attacker with a CA-signed certificate containing a name that extends or shortens an authorized hostname to impersonate other nodes. In Puppet Enterprise environments, this could enable attackers to access certificate authority functions and execute remote commands on managed infrastructure.

Vendors: [Puppet](https://junglewise.ai/threats/vendors/puppet).

## Quick answers

**Is CVE-2026-115732 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115732 being exploited in the wild.

**How severe is CVE-2026-115732?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Puppet Puppet Server; Puppet Puppet Enterprise.

**Is there a fix for CVE-2026-115732?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115732 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115732?** Check whether you run Puppet Server or Puppet Enterprise. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in trapperkeeper-authorization's certificate-name matching logic, allowing certificates with names that extend or shorten authorized hostnames to pass authorization checks. An attacker must obtain a CA-signed certificate with a colliding name (via approval or autosign) to exploit this. Successful exploitation grants the attacker the ability to impersonate authorized hosts and, in Puppet Enterprise, perform privileged operations including CA administration and remote code execution on managed nodes.

## Affected products

- Puppet Puppet Server
- Puppet Puppet Enterprise

## Timeline

- 2026-11-03: disclosed

## References

- [https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass](https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass)

## Related threats

- [Puppet Server deserialization of untrusted data in report processing](https://junglewise.ai/threats/cve-2026-115731-deserialization-of-untrusted-data-in-the-report-processing-code)
- [Puppet Enterprise open redirect in Console login](https://junglewise.ai/threats/cve-2016-5715-puppet-enterprise-open-redirect-in-console-login)