CVE-2026-115732

{
  "etk_id": "ETK-2026-3408",
  "cve_id": "CVE-2026-115732",
  "display_id": "CVE-2026-115732",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-116493",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Certificate name authorization bypass in Puppet Enterprise",
  "summary": "Affected Puppet Enterprise versions can incorrectly treat a client certificate with an overlapping hostname as an authorized node identity. An attacker who can obtain a CA-signed certificate with such a name may impersonate nodes and gain certificate-authority administrative access or execute commands on managed nodes.",
  "mitigation": "Upgrade Puppet Enterprise to 2023.8.13, 2025.12.1, or 2026.0.1, as appropriate for your release line. Until upgraded, tightly restrict certificate approval and autosigning to reduce the chance of issuing colliding certificate names.",
  "vendor": "Perforce",
  "product": "Puppet Enterprise",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2023.8.0, < 2023.8.13",
        ">= 2025.0.0, < 2025.12.1",
        ">= 2026.0.0, < 2026.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2023.8.13",
        "2025.12.1",
        "2026.0.1"
      ],
      "package_name": "Puppet Enterprise",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 36.40030965,
  "t0_at": "2026-11-03T20:38:24.169000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T20:38:24.169000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T20:38:24.169000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115732"
    }
  }
}